Drupal base_url incorrectly writing extra subdomain
This is not a Drupal-specific problem. This can easily be checked by creating a standalone PHP page and using the same code to test. Being that the variable is overwritten immediately after it is set shows that PHP/Apache is the one doing the overwriting.

It is possible for Apache to overwrite input and output. See: What would cause PHP variables to be rewritten by the server?