After reading through a closed bug for 3.9.1 I see that there was something to correct groups that contain an @ symbol in the name. That got me to wondering what other groups that I may have in my Active Directory which might contain stupid characters.
I searched one at a time for every standard ASCII '"special character" and I did encounter a user with a left parenthese in the username. It looks like someone had tried to copy and paste a phone number and they pasted it right into the username field! Since this was a disabled user, it went unnoticed. That *could* have been causing me grief?
After fixing this account I restarted the openfire service and I haven't had the group problems since then. But it's only been a couple of hours.
I will report back in the next few days. In the meantime, if this fixes matters, it might be good of OpenFire to search for any non alpha-numeric characters and find some way to handle them (even if it's only to ignore them and drop warnings into the log).