I found a script mistakenly named test in the $PATH that was related to some internal tools. This caused the update-ca-certificates to not complete properly as it was using the wrong test. As a result, there was missing root certs in the generated file(s).
Thanks for helping me find the errors in the log. That really got me going in the right direction.