Hi @dh54220
If it is 404 for content pages it means no AEM resource being accessed and processed. Please trace the referer path for /libs/cq/personalization (Not so sure but I believe, personalization being configured with AEM and there should be some other AEM resource (page/servlet/service) referring /libs/cq/personalization) and it could be from some component like header/footer (or any other component part of 404 page).
You can narrow down the Splunk logs by accessing path (which resolves to 404) to confirm whether /libs/cq/personalization is part of the 404 request.