Yep, I suspect it's Esri BUG-000119781
We found this 1-2 years ago. If your map service contains multiple layers based on the same data source, but each layer uses a different definition query to symbolize it differently it will do this.
The workaround is to publish the service with one layer with no or only 1 definition query and copy/paste different layers in the Webmap in AGO and give each one different symbology there. It's possible it works better in Portal but I don't know for sure.
If this isn't how your map service is set up and it's still doing this, you might want to put in a ticket and let them know. Hope this helps!