Thank you very much!
I may have found the issue. So the issue was caused by a piece of code in our plugin, which prevents executing the Remote Version Controller during ajax requests. It is used to protect server resources. In that case it falls back to old default values.
I corrected the controller script to use the cached or actual values instead. I re-scanned with WordFence to validate, and the issue seems to have been fixed, it no longer shows up.