On labpuppetmaster1001/1002, labstore1004/1005 and labtestpuppetmaster there's a broken pinning configuration, running "apt-cache rdepends" prints warnings, which probably means that the intended pinning config isn't working as expected:
jmm@labpuppetmaster1001:~$ apt-cache rdepends --installed xdg-utils xdg-utils Reverse Depends: reportbug reportbug debian-goodies W: Did not understand pin type 3.0.0-4+deb9u2~bpo8+1 W: Did not understand pin type 1.2.9-9+deb8u5 W: Did not understand pin type 1.2.9-1 W: Did not understand pin type 1:2.8+dfsg-3~bpo8+1