Okay thanks for pointing that out! For anyone else looking, you have to sanitize your output to remove the private fields when using strapi.entityService to retrieve entries.
async find(ctx) {
...
const sanitizedResults = await this.sanitizeOutput(entries, ctx);
const transformed = this.transformResponse(sanitizedResults);
return transformed;
}