I found the culprit. It was WP-Spamshield causing this issue.
I’ve turned their plugin off for now, and my last few test invoices just updated as paid, so it looks like that’s it. I’m not sure how to keep using that plugin but would like to re-enable it – do you know what needs to be done to make them both work? (maybe they don’t know of your plugin or there’s a hook or something we can add on our end)