One final update, incase anyone else runs across this issue: The problem boiled down to the launchd script in question being installed into the ~/Library/LaunchAgents directory. Because config files from the user's own LaunchAgent directory will cause the process to be run under that user's ID and not root, every 10 seconds an attempt was made to restart nginx, and it failed, writing to the same error log that my manual restarts from the command line with sudo did. I was mistaking them for something generated by my sudo commands.

I never saw the extra nginx processes, because they exited out too fast for me to catch them.