So I think I managed to get this solved. I had a rule for blocking admin* in the url, which worked fine until this most recent update. This prevented anyone from either typing ?user=admin in the url or wp-admin in an attempt to gain access to any core directory files (/wp-admin/XXXXXX.php). The problem seemed to only be after a user landed on the site. Once they clicked a link (as I tested in multiple browsers) it tripped a call to wp-admin in AJAX and that caused the lockout.
What changed in the recent update to cause this error?