I found this stray code in the header.php
$GLOBALS[blog_id] = get_option('woo_blog_id');
This wiped out the global variable that get_current_blog_id()
relies on to get the site id in multisite. This is then used by wp_get_attachment_url()
to build the appropriate URL.
Because I was getting an incorrect site id, my attachment URLs were coming out wrong.