Been working with Yealink support on this and after confirming this happening with the T46G and the T42G phones, their support upped the severity and I got an answer back to add the below setting to the configuration files.

transfer.hang_up_after_success_trans = 3

I did so on the T46G, disabled the custom firewall rules, and had the operator repeat the transfer.

No ghost ringback.

I'll leave the custom firewall disabled and see if it stays good all day.

I'll test in more detail over the weekend or on Tuesday, whichever time I have a tech on site.