I believe this is due to this change: https://www.drupal.org/node/3201242 →
Access checks must be added in the module. I wrote a patch that adds access checks to entity queries in the mentions module which solved one of the problems for me. I've added the patch.
pkok → created an issue.
I can confirm that the patch in #4 fixes this issue.