Routine usb_dci_khci_postinit() enables the D+ pullup resistor, enables the USB module, and clears the Suspend condition on the bus. Presumably, there is an equivalent routine in ehci_dev.c, but I haven't looked for it.
usb_dci_khci_postinit() is called through usb_device_postinit().
Every device class driver's class init routine includes a call to usb_device_postinit().
That specifically includes usb_composite.c, the Composite device class driver.
This means that a composite device is going to issue several calls to usb_device_postinit(). This is probably OK for now, until/unless someone adds code to the routine that should only be executed once.
Suggested fix: Wrap the calls in usb_audio.c, usb_dfu.c, usb_hid.c, usb_msc.c, ..., in #if !USBCFG_DEV_COMPOSITE/#endif pairs. This guarantees that devices compiled as standalone devices (not composite) will execute the call as always, and composite devices will only execute the call in usb_composite.c.