I think I’ve figured it out. Apparently now Docker also adds an 192.168. range on top of 172. ranges for its bridge networks:
docs.docker.com/engine/network/#automatic-subnet-…
Copy that example to your /etc/docker/daemon.json on all your docker machines, without the 192.168 line, and restart docker, and the 192.168.65. addresses will go away.
(Don’t forget to remove the trailing comma on the last address line.)
Mind you, this won’t solve anything, just remove some potential conflicts with your LAN. You will still see clients appearing to come from bogus addresses, except they’ll be in 172. ranges now.