Aha, that's interesting... Looks like the Team City build logs do not show the "/deterministic+" flag on them, and the Azure Pipeline builds do. That's the only difference between the two sets of log outputs. That might be the whole thing. Now I have to figure out where that's controlled, deep in our configuration files somewhere.

Update: Actually, some of the modules have it and some of them don't. The one I was examining didn't have it originally, and when I added the <Deterministic>true</Deterministic>, the parameter showed up and was used in the CSC command line. Yet the files still had the same differences. So back to square one.