Part 1 - why are dynatracemonitor calls still being made under these circumstances?
There look to be 3 different dynatracemonitor calls being made:
1) Ones with parameters passed, I assume these are genuine attempts to pass back UEM data to the web server. Here is an example:
In fact all of the calls where parameters are passed look to be related to /WebClient_SSO//blank/blank.htm.
2) Ones with no parameters passed and which return the same html as those with parameters passed
3) Ones with no parameters passed but which return the following:
Part 2 - please clarify what these 3 different dynatracemonitor call types are doing?
I could attach a slightly sanitised fiddler trace if required (would have to remove some calls with some potentially sensitive data).
I'm starting to answermy own question after further digging. It appears that all the dynatracemonitor calls are from a .../blank/blank.htm page which is a placeholder page with an explicit cache expiry set that is very very long (and shouldn't be). Excluding this page should stop all the unneeded dynatracemonitor calls whilst we sort out the root problem.
To continue the answer of your own question. You will receive dynaTraceMonitor signals as long as there are pages out there that load our agent. If you have any caches like you - or if you use CDNs that cache your pages it could take a while until your UEM changes take effect