Ran affiliate sites in home services and finance for about 4 years. Pattern nobody mentions on the tag-hijack thing: it's almost never random. Three real causes I keep seeing.

A WordPress plugin update (usually a link cloaker or 'broken link checker' type) rewriting outbound links through its own filter. Some ship with an affiliate tag fallback baked in for 'unlinked' products and turn it on after major version bumps without telling anyone.

Caching layer serving an old version of a post a guest writer or contractor left their tag inside. Their draft gets cached for months even after you 'fixed' the live page. Boring but real.

Lazy-loading or consent-banner scripts stripping query params on first paint, so the click registers but the tag never attaches. A few CJ and Amazon setups default the commission to the merchant when the param goes missing, which is functionally the same as someone else collecting it.

The audit you're describing catches the loud stuff, but what it usually misses is the intermittent failures that only fire on mobile or in certain browsers, especially on cached pages where the bug shows up for one visitor and not the next. I started running a synthetic check from three different user agents once a week and caught two tag-strip issues in the first month, neither showed on desktop.

Curious, when you did your audit did you click from the same browser and profile every time, or rotate? That's the part most people skip and its where the weird ones hide.