debug.log shows this is definitely appearing more than the number of modified nodes (and we're setting DoS for nodes doing this).
Theory is wallets getting transactions cleared and stored with 0-bytes instead of their value.