Android 12 cellbroadcastreceiver permission denial causing high CPU usage in com.android.phone process?

Every since my Nokia 5.3 was upgraded to Andoid 12 recently, the battery suffers from processes com.android.phone and qcrild using the CPU a fair amount. It is not completely reproducible, but it happens especially when the the phone is locked, or at least the screen is off. I observe that increased CPU usage via adb shell top -u radio. At that same time adb shell dumpsys phone shows a lot of the following:

❯ adb shell dumpsys phone
------- PhoneGlobals -------
  mPrevRoamingNotification=0
  mDefaultDataSubId=1
  mDataRoamingNotifLog:
  isSmsCapable=true
    2022-11-23T13:56:23.510818 - dataAllowed=true, reasons=Data allowed reason: NORMAL
    2022-11-23T13:56:23.512116 - dataAllowed=true, reasons=Data allowed reason: NORMAL
[snip rest of the output]

And that seems to always immediately follow these adb shell logcat -d phone warnings about ...without a qualified user and Permission Denial to read the phone state:

11-23 13:56:23.460  1681  3481 W ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.sendBroadcastMultiplePermissions:1206 com.android.server.TelephonyRegistry.broadcastServiceStateChanged:2880 com.android.server.TelephonyRegistry.notifyServiceStateForPhoneId:1608 com.android.internal.telephony.ITelephonyRegistry$Stub.onTransact:455 android.os.Binder.execTransactInternal:1184
11-23 13:56:23.461  1681  3481 W ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.sendBroadcastMultiplePermissions:1256 android.content.Context.sendBroadcastMultiplePermissions:2215 com.android.server.TelephonyRegistry.broadcastServiceStateChanged:2884 com.android.server.TelephonyRegistry.notifyServiceStateForPhoneId:1608 com.android.internal.telephony.ITelephonyRegistry$Stub.onTransact:455 
11-23 13:56:23.462  1681  3481 W ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.sendBroadcastMultiplePermissions:1256 android.content.Context.sendBroadcastMultiplePermissions:2215 com.android.server.TelephonyRegistry.broadcastServiceStateChanged:2891 com.android.server.TelephonyRegistry.notifyServiceStateForPhoneId:1608 com.android.internal.telephony.ITelephonyRegistry$Stub.onTransact:455 
11-23 13:56:23.463  1681  2031 W BroadcastQueue: Permission Denial: receiving Intent { act=android.intent.action.SERVICE_STATE flg=0x1000010 (has extras) } to com.google.android.cellbroadcastreceiver/com.android.cellbroadcastreceiver.CellBroadcastReceiver requires android.permission.READ_PHONE_STATE due to sender android (uid 1001)
11-23 13:56:23.463  1681  2031 W BroadcastQueue: Permission Denial: receiving Intent { act=android.intent.action.SERVICE_STATE flg=0x1000010 (has extras) } to com.google.android.cellbroadcastreceiver/com.android.cellbroadcastreceiver.CellBroadcastReceiver requires android.permission.ACCESS_FINE_LOCATION due to sender android (uid 1001)
11-23 13:56:23.464  1681  3481 W ContextImpl: Calling a method in the system process without a qualified user: android.app.ContextImpl.sendBroadcastMultiplePermissions:1256 android.content.Context.sendBroadcastMultiplePermissions:2215 com.android.server.TelephonyRegistry.broadcastServiceStateChanged:2895 com.android.server.TelephonyRegistry.notifyServiceStateForPhoneId:1608 com.android.internal.telephony.ITelephonyRegistry$Stub.onTransact:455 
11-23 13:56:23.465  1681  2031 W BroadcastQueue: Permission Denial: receiving Intent { act=android.intent.action.SERVICE_STATE flg=0x1000010 (has extras) } to com.google.android.cellbroadcastreceiver/com.android.cellbroadcastreceiver.CellBroadcastReceiver requires android.permission.READ_PHONE_STATE due to sender android (uid 1001)

And that results in a lot of logging that seems to be about refreshing the data about my mobile carrier (onRefreshCarrierInfo()), which may be where the CPU time is actually spent (following log capture is from a later occurrence):

11-23 14:18:08.592  2936  2936 D ServiceStateProvider: subId=1
11-23 14:18:08.592  2462  2640 I CustomizedNetworkIcon: getConfigValueByKey: oem_key_rat_name_of_4g_int=0
11-23 14:18:08.595  2462  2640 I CustomizedNetworkIcon: getConfigValueByKey: oem_display_lte_icon_int=1
11-23 14:18:08.597  2936  2936 I Telephony: TelecomAccountRegistry: onSubscriptionsChanged - reregister accounts
11-23 14:18:08.598  1676  2040 D CompatibilityInfo: mCompatibilityFlags - 0
11-23 14:18:08.598  2936  2936 D Telephony: isEmergencyPreferredAccount: subId=1, activeData=1
11-23 14:18:08.598  1676  2040 D CompatibilityInfo: applicationDensity - 280
11-23 14:18:08.598  2936  2936 D Telephony: isEmergencyPreferredAccount: Device does not require preference.
11-23 14:18:08.598  1676  2040 D CompatibilityInfo: applicationScale - 1.0
11-23 14:18:08.600 31066 31066 D CellBroadcastReceiver: onReceive Intent { act=android.intent.action.SERVICE_STATE flg=0x1000010 cmp=com.google.android.cellbroadcastreceiver/com.android.cellbroadcastreceiver.CellBroadcastReceiver (has extras) }
11-23 14:18:08.600 31066 31066 D CellBroadcastReceiver: onServiceStateChanged, ss: 0
11-23 14:18:08.600 31066 31066 D CellBroadcastReceiver: networkOperator: 20416
11-23 14:18:08.600 31066 31066 D CellBroadcastReceiver: update supported roaming operator as
11-23 14:18:08.601  2936  2936 I Telephony: isRttCurrentlySupported -- regular acct, hasVoiceAvailability: false
11-23 14:18:08.601  2936  2936 I Telephony:  isRttSupported: false
11-23 14:18:08.601  2936  2936 I Telephony:  isUserRttSettingOn: false
11-23 14:18:08.601  2936  2936 I Telephony:  alwaysAllowWhileRoaming: false
11-23 14:18:08.601  2936  2936 I Telephony:  isRoaming: false
11-23 14:18:08.601  2936  2936 I Telephony:  isOnWfc: false
11-23 14:18:08.607  2462  2640 E CustomizedImsIcon: customizedVoLTEandVoWiFiIcon:
11-23 14:18:08.608  2462  4440 I CustomizedImsIcon:  customizedImsIcon:++
11-23 14:18:08.608  2462  4440 D CustomizedImsIcon: isAirplaneModeOn: false
11-23 14:18:08.608  2462  4440 D CustomizedImsIcon: customizedImsIcon:clear all vowifi icon which is added with TAG when airplane is off
11-23 14:18:08.608  2462  4440 I CustomizedImsIcon:  isOperaterCustomized:mccmnc=20416
11-23 14:18:08.609  2462  4440 I CustomizedImsIcon:  isOperaterClaroCustomized:mccmnc=20416
11-23 14:18:08.609  2462  4440 I CustomizedImsIcon:  isCustomizedBySkuId:isCustomized=false
11-23 14:18:08.609  2462  4440 D CustomizedImsIcon: getSimCount: simCount=1
11-23 14:18:08.610  2462  4440 I CustomizedImsIcon:  isWifiCallingAvailable: isImsRegistered is false
11-23 14:18:08.610  2462  4440 I CustomizedImsIcon:  isShowVoWiFiIcon: isAllowed=false
11-23 14:18:08.612  2462  4440 I CustomizedImsIcon:  isAllowShowVoLteIcon:OEM_ALLOW_SHOW_VOLTE_ICON_BOOL=false  phoneId=0
11-23 14:18:08.612  2462  4440 I CustomizedImsIcon:  isShowVolteIcon: isAllowed=false
11-23 14:18:08.613  2462  4440 I CustomizedImsIcon:  customizedImsIcon:--
11-23 14:18:08.615  2936  2936 I Telephony: reRegisterPstnPhoneAccount: subId: 1 - no change
11-23 14:18:08.615  2936  2936 D CallNotifier: updatePhoneStateListeners: update CF notifications.
11-23 14:18:08.616  2936  2936 I NotificationMgr: updateCfi: subId= 1, visible=N
11-23 14:18:08.616  2936  2936 I NotificationMgr: updateMwi(): subId 1 update to false
11-23 14:18:08.618  2462  2462 D KeyguardUpdateMonitor: received broadcast android.intent.action.SERVICE_STATE
11-23 14:18:08.618  2462  2462 V KeyguardUpdateMonitor: action android.intent.action.SERVICE_STATE serviceState={mVoiceRegState=0(IN_SERVICE), mDataRegState=0(IN_SERVICE), mChannelNumber=1656, duplexMode()=1, mCellBandwidths=[], mOperatorAlphaLong=Simpel, mOperatorAlphaShort=Simpel, isManualNetworkSelection=false(automatic), getRilVoiceRadioTechnology=14(LTE), getRilDataRadioTechnology=14(LTE), mCssIndicator=unsupported, mNetworkId=-1, mSystemId=-1, mCdmaRoamingIndicator=-1, mCdmaDefaultRoamingIndicator=-1, mIsEmergencyOnly=false, isUsingCarrierAggregation=false, mArfcnRsrpBoost=0, mNetworkRegistrationInfos=[NetworkRegistrationInfo{ domain=CS transportType=WWAN registrationState=HOME roamingType=NOT_ROAMING accessNetworkTechnology=LTE rejectCause=0 emergencyEnabled=false availableServices=[VOICE,SMS,VIDEO] cellIdentity=CellIdentityLte:{ mCi=70817281 mPci=66 mTac=527 mEarfcn=1656 mBands=[] mBandwidth=2147483647 mMcc=204 mMnc=16 mAlphaLong=Simpel mAlphaShort=Simpel mAdditionalPlmns={} mCsgInfo=null} voiceSpecificInfo=VoiceSpecificRegistrationInfo { mCssSupported=false mRoamingIndicator=1 mSystemIsInPrl=-1 mDefaultRoamingIndicator=-1} dataSpecificInfo=null nrState=**** rRplmn=20416 isUsingCarrierAggregation=false}, NetworkRegistrationInfo{ domain=PS transportType=WWAN registrationState=HOME roamingType=NOT_ROAMING accessNetworkTechnology=LTE rejectCause=0 emergencyEnabled=false availableServices=[DATA] cellIdentity=CellIdentityLte:{ mCi=70817281 mPci=66 mTac=527 mEarfcn=1656 mBands=[] mBandwidth=2147483647 mMcc=204 mMnc=16 mAlphaLong=Simpel mAlphaShort=Simpel mAdditionalPlmns={} mCsgInfo=null} voiceSpecificInfo=null dataSpecificInfo=android.telephony.DataSpecificRegistrationInfo :{ maxDataCalls = 20 isDcNrRestricted = false isNrAvailable = false isEnDcAvailable = false LteVopsSupportInfo :  mVopsSupport = 3 mEmcBearerSupport = 2 } nrState=**** rRplmn=20416 isUsingCarrierAggregation=false}], mNrFrequencyRange=0, mOperatorAlphaLongRaw=Simpel, mOperatorAlphaShortRaw=Simpel, mIsDataRoamingFromRegistration=false, mIsIwlanPreferred=false} subId=1
[...snipping a lot more similar logging...]

What could be wrong? Or at least, how can I further debug this?