I figured out my issue...
MongoDB user I was using had a readWrite role, but I guess it needs the dbAdmin role as well. When I tried creating a new user in the nodebb admin area, then it would make things go wonky without the dbAdmin role and result in invalid csrf tokens.
rples created this issue in NodeBB-Community/nodebb-plugin-custom-pages
Missing csrf token middleware on creating route