The new DHCP server, isc-kea, has a flaw in raw socket handling that allows the server to reply on both the untagged and tagged VLAN for DHCP requests received on a tagged VLAN.

https://vyos.dev/maniphest/task/edit/form/3/?projectPHIDs=PHID-PROJ-lqdessb2askslz5majbs

The issue is first resolved in version 3.1.7: https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Notes/release-notes-3.1.7

The first production version with a fix is 3.2.0. In order to upgrade to the new server version, the configuration supplied to the server must be updated. The updated syntax scopes interfaces to the DHCP subnet instead of simple server server.