Still don’t know the exact root cause, but a ticket is currently open with Microsoft. It is somehow related to Bitlocker. Turning off Bitlocker before upgrading eliminates the problem. Microsoft is investigating, but since I’ve had so much trouble and time spent on this, I thought I’d post this in the hope I save some other sysadmin the headache.
This was a hard one to Google. Turns out, upgrading in-place from Windows 8.1 to Windows 10 resets NTP settings to defaults per Microsoft. Solution is to either unregister and re-register w32tm or create a GPO for NTP settings.