WP adds long version query strings to CSS and JS files

When disabling plugins I traced the issue.
Apparently it’s the WordFence plugin.

This query string is from the option “Hide WordPress version” — it replaces the original “ver=” string that already appears on the static content. If you uncheck that box, you will see the original version numbers instead, without any changes from Wordfence.

It shouldn’t affect any pageload scores, since it is only replacing a version string that already exists, but may affect browser caching if you need query strings to change to cause an asset to expire. In an upcoming version of Wordfence, this part of the query string will only be replaced if the “ver=” string matches the WordPress version, so it will not hide the original version string of other assets.