In OIDC module 4.4.0, this behavior is expected.
When OIDC.CustomUserProvisioning is configured, it does not replace CUSTOM_UserProvisioning.
Both can run in the same login flow:
So if the same microflow is referenced in both places, it can be executed twice.