Thanks for getting back

The 'SQL Server Agent account' is being used in the Log Reader Agent and the SnapShot Agent under publication properties => agent security

Still trying to understand where else sa is being used in this.. Somewhere in my setup sa is configured.

The monitor appeared to be broken, not replication itself but this is only a hunch because tablediff was clean (this has very active replication processes) and tracer tokens were getting through (I verified this before putting the password back and we were not getting paged or emails for a week)