As a quick update... the team (which @joshiga is a vital part of) thinks that there might be multiple bugs in play here. 

That said, checking if the issue persists with virtualized APIC disabled is important because it helps us divide the line between different bugs. It's a fun combination of us, CPU and MS bugs all coming together for a big crash party, so we're trying to lay out the best path forward without pointing too many fingers or having to wait for OS or CPU Microcode updates.

monitor_control.disable_apichv = "TRUE"