The routers in question run a BGP redistribution process every 60 seconds and it just happened to run (quite often) just as filters were being rewritten, resulting in "the gunk" not being tagged as "keep internal" and therefore being advertised externally. A subsequent run of the BGP process realized a policy was in place withdrew the routes.

I should clarify here: A subsequent run of the BGP resdistribution process with the newly rewritten policy in place resulted in the routes being tagged with the appropriate "keep internal" community and "re- advertised". Upon receipt of the now tagged routes, routers that had previously announced the untagged routes withdrew them (per egress policy specification). -danny