It wasn't actual WoL. It was broadcasts. For some reason it woke the Mac up when WoL was switched on. We're taking 2015 or so so I don't have the packet logs anymore but I was able to replicate it by resending them.

So the fault is really the Mac's. It should only accept real well formed WoL packets with its own Mac address.