Without seeing actual hostnames, we can only speculate. But it sounds like a server misconfiguration to me. The browser sends a host header, so it’s up to the server to send the correct response for that hostname.
Does that help at all? Sounds like you’re suggesting that the config on one of the webservers was what was causing it? Confused as to why root traffic got to Kinsta at all.
DNS is not by strong suit so really appreciate the help. Thanks
Kinsta uses Cloudflare. So if you’ve ever added a site to Kinsta, they probably added your domain to their Cloudflare account and now have control over one or more of your domain hostnames. You would have to ask Kinsta to remove that from their Cloudflare account. WP Engine does the same thing, so keep that all in mind since they control your Cloudflare settings for what they host.