This is apparently one of too many regressions in firmware 7.44 as compared to 7.2a
Apparently, if an APN is defined (either through +CGDCONT or WIP library), this APN is copied to AT+WDSS, and remote management gets turned on.
On the units we discovered this, the APN had been set once, but not been explicitly removed with AT+CGDCONT.
The stopgap solution we found is that once we remove the APN with AT+CGDCONT, and reboot, it is removed from +WDSS as well and remote management gets turned off.
I’m told this was fixed in 7.45, but I have only checked 7.46 and the issue is fixed there at least.
I couldn’t see anything in the release notes that indicate this issue was there at all.