Thanks! I found the CEIP setting and disabled it. I'm pretty sure we disabled this before in 11.3. Was it set to "on" again during the 11.4 upgrade? That's not cool.
Ok, I found in https://community.rsa.com/docs/DOC-111790 that in 11.4.1 the first admin login should receive a pop-up to enable this feature. We have 2 separate environments and there is no way we would have accidentally enabled CEIP in both of them. Seems like the pop-up idea didn't work but CEIP was enabled anyway. I'm glad we caught this now though.