Some Updates:
After upgradeing the vCenter 6.0 appliances to 6.5, we noticed that with 6.7 we saw some other issues:
The PSCs when going from 6.5 -> 6.7 also had some duplicate root certificates.
At the end of the day, all appliances, vCenter or PSC, need to have any duplicate roots removed JUST prior to the upgrade.
It is critical that you do not restart any services. Simply SSH into the box just prior to upgrade (after you've shut down the entire vCenter appliance environment and take snapshots) and kill the duplicate certificates.
With the 6.5 upgrade installer, it doesn't notify you of any cert issues. The 6.7 upgrade installer is MUCH better, and will warn you of these issues.