This is very simple. On all dashboard and similar signed-in pages, there's exactly zero applicable third party code.
If you think otherwise you do not in any way take "the privacy of our customers’ data and personal information very seriously".
As such, you should be much more specific about what you mean with "we removed the offending code".
If you never intended for third party scripts to run on the dashboard page, well then you got some serious explaining to do as to how your deployment process let that slip.
We also subsequently removed Google Tag Manager from the private pages.
This is good. However, the question then becomes how on earth did Google Tag Manager get added to those pages to begin with?
Either you did not consider this a cause for concern, or it slipped past your code review. In either instance, how could I ever trust you with my data?
That question needs a serious answer.