I'm going to put some findings here as they won't fit in a comment.....
For those of us that know about SPoRT, I searched all the current SPoRT Tomcat logs for occurrences of the SSLHandshakeException and found them not too many days after we released our newly minted 4.0.7/WebSphere out to the wild.   I then searched SPoRT logs from the older setups and only found the SSLHandshakeException on connection attempts to the one lone WebSphere we had at the time ( as far back as April 2014 )

In our WebSphere logs we can sometimes see complaints of distrust of an SSL certificate, but it does not reference the configured default certificate, rather the WebSphere created "default" certificate.    Said another way, our NodeDefaultKeystore has 3 items:  Automatically created ssl and root certificate(s) and an installed certificate which is configured on the SSL Settings as the server and client certificate.   I verified this was also the case in our previous WebSphere configuration; now it is similar across all.   Thus a possible cause is that on occasion, the wrong certificate is handed out and it doesn't pass muster.

I think the solution would be to remove that "default" certificate and possibly the root certificate, but I am waiting to be advised via the PMR I created.