After hours of confusion for us it seems the answer was that iOS 17 now automatically encodes query parameters (seemingly regardless of whether or not they are already URL-encoded).
For apps linked on or after iOS 17 and aligned OS versions, URL parsing has updated from the obsolete RFC 1738/1808 parsing to the same RFC 3986 parsing as URLComponents. This unifies the parsing behaviors of the URL and URLComponents APIs. Now, URL automatically percent- and IDNA-encodes invalid characters to help create a valid URL.
https://developer.apple.com/documentation/foundation/url/3126806-init