Cannot turn off certificate trust setting under iOS 11.2.6/11.3

I have recently installed a new root CA (and trusted it) on several iOS devices. This was replacing an older certificate which has been removed from the list of Profiles. However, the older root CA still appears in the list of certificates under Certificate Trust Settings and cannot be turned off or deleted. The Certificate Trust Settings on the phones shows both the old and new CAs and trust for the old CA cannot be turned off. This is under iOS 11.2.6 and 11.3 on several different models of iPhone.

I've fired up Apple Configurator to look at the profiles stored on the phones and only the new root CA is there.

I've tried reinstalling the old CA to see if that will let me turn it off, then delete it again. No joy.