'pretty standard' could be anything. Given the details provided I can only help you to try and find the problem - reason for it being there in the first place and what to actually do about it is a different story. But, let's give it a shot:

Enable Developer Mode (https://www.odoo.com/documentation/18.0/applications/general/developer_mode.html), then navigate to Settings -> Technical --> User Interface -> Views.
In there, perform a search for View Architecture 'web.csrf_token':

From here it's guess work, mainly because I wouldn't be aware about any occurrence of web.csrf_token in any recent Odoo version, hence Odoo can't find it either.

The correct call would be for request.csrf_token(), in case we're taking about a t-att'd value-attribute for a hidden input field (for example https://github.com/odoo/odoo/blob/18.0/addons/portal/views/portal_templates.xml#L444). If you happen to find a record matching that search criteria, this is your troublesome view. Chances are that it in fact is within the mentioned project.portal_my_task template.

Another reason could be that the xml parsing leads to the 'assumption' it is about web's csrf_token-view - which would mean, in case you can't find anything with above search, that you'll have to search for View Architecture 'csrf_token' only (without web.) - which will return quite some results. Again, chances are it is actually about a modification done directly within project.portal_my_task, so maybe try and go for that view in the beginning anyways.

Since the csrf token is needed for a web form to work properly and if a custom form added to the project view in question rings a bell, that's where you have to go start digging.