In reply to James Laws.

Looks like my scanner flagged some campaign utm's in functions.php, not cookies.