It seems that when using CI_COLCON_BRANCH, the colcon repositories are cloned into a subdirectory of the workspace. Though colcon itself doesn't consider the subdirectory to be part of the workspace sources, it seems that vcstool does, and attempts to check out CI_BRANCH_TO_TEST in each colcon repository, possibly overriding CI_COLCON_BRANCH.
It seems that when using CI_COLCON_BRANCH, the colcon repositories are cloned into a subdirectory of the workspace. Though colcon itself doesn't consider the subdirectory to be part of the workspace sources, it seems that vcstool does, and attempts to check out CI_BRANCH_TO_TEST in each colcon repository, possibly overriding CI_COLCON_BRANCH.