I just resolved this.
I found that the account which had SuperAdmin group also had Registered group, and that had 'Default Blacklist' applied.
So it appears that the filtering uses the 'most restrictive' of those applied.
But just removing the 'registered' group it resolved the issue.
Still not sure how this started showing as we haven't changed any of those filtering settings - maybe changes in J3.8.12?
Either way, this issue is resolved and closed.