Does Adobe collect and store referrer data as this can potentially contain the
CUSTID parameters which have PII information?
Adobe doesn’t collect any PII data itself. If the customer is passing any PII data to Target via mbox parameters or any other method, then they are responsible for it, and they should not send such data to Target.
If the customer has mistakenly used eVar to collect an attribute they consider to be sensitive, they should discontinue this practice.