The kafka/analytics hosts have a broken apt config:
Running "apt-get update" shows "Unable to find expected entry 'thirdparty/confluent/source/Sources" in Release file".
/etc/apt/sources.list.d/thirdparty-confluent.list in fact adds "thirdparty/confluent" for jessie-wikimedia, but it only exists for stretch. This current prevents apt from noticing new package changes, e.g. "apt-get install debmonitor-client" fails as a consequence.