I can't go into the other details right now, but a customer reported the same thing: after the upgrade they still had rotating services. The only difference during the upgrade procedure compared to all others I have done so far was that they had failed the MGR multiple times during the upgrade. I recommended to run the upgrade again (with the same image, obviously) so the services would be properly rotated.
Sorry, I think I misunderstood this on my first reading. Do you mean go through and rotate the mon and mgr keys on the existing cluster and see if that helps? I was thinking you meant roll back the cluster (like a bunch of VMs or something) and try again, but that doesn't seem so likely, now that I think about it. I should just try the key rotations again?