Behaviour attach triggering twice
I put a breakpoint on one script's attach behaviours and inspected the call stack both times it was called.

The first time was expected, from drupal.js, and the second turned out to be from a call in the EU Cookie Compliance module. This turned out to be a bug in the EU Cookie Compliance module.

Thanks for comments. I'll leave this here in case anyone else of the 70.5k users of that module experience the same issue!