@StephenMoll, from what you described, the indication is that you are hitting a known issue which is fixed in VCF 9.0.1 which is scheduled to be released soon.
There is an in-place workaround for this issue but engineering did not confirm with GS whether making that information publicly available will be permissible (will follow-up with colleague that engaged with them for possible further clarification on that aspect).
This issue only impacts Witnesses deployed on version 9.0.0 so another feasible workaround is to deploy one using a previous version then update it.