It sounds like you are correct. Do you have another one, if so try it and see if the problem goes away. Hopefully it is from a different batch/lot. Is it a real Atmega328P (ATmega328PB) or a "counterfeit" one? It may have been a rejected unit that got in through the black market channel. At over 10 Billion to build a FAB I do not expect many fabs built to counterfeit chips. However they could come up with a design and have it go through a for-hire fab, a much cheaper option.