While trying better understand where all those darn symbols are coming from, I discovered that Active Admin is very leaky: https://github.com/gregbell/active_admin/pull/1926 These are the hacks I developed in that journey. Hopefully this helps someone else!

attack_of_the_symbols.rb

# At the beginning of each web request, log the current number of symbols in memory.
class ApplicationController < ActionController::Base
  protect_from_forgery
  @@sym_count_logger = Logger.new('log/sym_count.log')

  before_filter do
    @@sym_count_logger.info Symbol.all_symbols.count
  end
end

# Monkeypatch for logging any new symbols as they're created
# This is useful as a general tool, to see what your application is doing, and when it's doing it.
class String
  @@sym_logger = Logger.new('log/sym.log')
  alias_method :original_to_sym, :to_sym
  def to_sym
    temp = Symbol.all_symbols
    unless temp.include? original_to_sym
      @@sym_logger.info "#{self} \033[36m(#{caller.first[/(lib|app).*/]})\033[0m"
    end
    original_to_sym
  end
  alias_method :intern, :to_sym
end

# Monkeypatch for manually confirming whether I can get an arbitrary string to be symbolized
# I raise a ActionNotFound error because that's much more likely to bubble up the stack.
class String
  alias_method :original_to_sym, :to_sym
  def to_sym
    if self == 'really_long_malicious_key'
      Rails.logger.fatal "WAT \033[36m(#{caller.map{|a| a[/(lib|app).*/] } })\033[0m"
      raise AbstractController::ActionNotFound
    end
    original_to_sym
  end
  alias_method :intern, :to_sym
end

# Note that for the exception above to be raised, you need one more monkeypatch:
class Hash
  # removed the unconditional `rescue` that would otherwise silence the errors we try throwing
  def symbolize_keys!
    keys.each do |key|
      self[key.to_sym || key] = delete(key)
    end
    self
  end
end