WP Cerber seems to be adding encrypted query strings to the end of get form URL

I have a custom post type, custom search form, all using WP registered query args (add_query_arg). So when I submit the form (method=get), it adds them as a query string on the end of the URL.

While not logged in, I submitted a search, and realized there was a LOT more in the URL than normal. There is an extra 208 characters being added. Exactly 2 new &key=value pairs, but they’re both the same. I went through enabling/disabling all plugins, and realize it’s the WP Cerber plugin that’s adding it.

Any idea what this could be?