Just want to give an update in case it helps:
- issue was application users from the old vcenter were still registered in web client
- web client > administration > sso users and groups > application users
- problem was i couldn't tell which user belonged to the dead vcenter as they do not have references to hostnames or IP, did not want to risk deleting the wrong ones
- end up restoring the dead vcenter from backups, then did a full uninstall of vcenter, which deleted the proper application user accounts from web client
all is good now
