After a little more poking around with VisualVM, this seems to be the result of a java.security.ProtectionDomain instance hanging onto the web application. This gets loaded when rendering is triggered with an image.
Clearing caches with clearCache obviously won’t help. At this point, I’m not sure how to manage the issue.
Any thoughts would be greatly appreciated.