It looks like the server is adding that anchor when it creates the certs in /etc/certificates, to which it then points the various service configs. I'm chasing that down.
Still not sure that this the cause of the original issue. Hopefully my user will get back to me with the Outlook certificate path.