I did a level 6 trace on apache's rewrite for one request to the baseUrl.
Everything looks correct and the passthrough path is what it should be for CI to work. So the duplication of the userdir url segments is happening in the CI request class before it gets to the router.