seems as if your users are the QA for new versions again...
The custom path for the signing tool in 17.4.1 is not static. It changes depending on the logged on user...
Attached you can see two pictures.
On my development machine I set the path to:
As soon this is transfered to the build agent, it chenges to:
So somehow the running Windows user is added to the path.