I discovered that it was happening on one multi-site install, but not another, on the same server. And then even on the problematic installation, it was not happening with every domain. Although it made no sense, and was perhaps just coincidence, deleting the domain mapping record for the problematic domain, and re-creating it, solved the issue. Cookies were also cleared locally.
So, not much troubleshooting help, but it worked for my particular instance.