A client reported that OpenNMS was discovering services that were set scan=off in the capsd-configuration.xml file. I suggested that it might be provisiond somehow operating on these nodes unintentionally, and that they should edit the default foreigh source and see if it helped. It did.
So, I decided to recreate the issue. Spun up a VM, installed a fresh 1.8.7, edited capsd so that scan was only set to "on" for ICMP and started discovery. It discovered a number of services besides ICMP.
Workaround: make sure your default foreign source matches your capsd-configuration.