2👍
✅
I found the root cause which was Djangular, which has a middleware that was appending the bad characters to the beginning of the JSON.
'djangular.middleware.AngularJsonVulnerabilityMiddleware'
Hopefully that saves someone some time.
Source:stackexchange.com