Since we expect CNAME cloaking to be disabled soon with Safari and it already is with Brave, we need a short-term solution for consistent identity resolution for anonymous visitors to bridge the gap before a full transition to CJA or AEP.
Do you have an internal visitor ID? Sync it with the visitor api service.
It gets worse than just cname... do you use audience manager? Demdex cookies are 3rd party...