I've been able to reproduce and narrow down the issue. The affected table that is included in the RLS rules has a many-to-many one-directional relation with our central Fact table (and one-directional security as well). Removing this filter in RLS removes the issue with overlapping roles and users - be it that the RLS is not filtering appropriately. The RLS also works when removing the many-to-many relationship and rewriting the RLS DAX filters based on the disconnected table.
It seems like the way additive RLS works changed, rather than giving a unioned result set it throws and error when roles have "conflicting" filters on many-to-many tables regardless of the type of filter (security or regular). As said we have had no issues with this in the past.