2816 Switch - VLAN 17 traffic on VLAN 1

I have a very simple setup that I can not seem to get working.

As a test I set up a vlan (17) on two ports on an old 2816 switch (it had been completely factory reset).

• Only ports 11 and 13 are on vlan 17
• Both are set to untagged
• Both are set to PVID 17
• No other ports are in VLAN 17

From my understanding this should isolate those two ports so that they can only speak to each other. 

However, I have a router on port 1 (VLAN1) and devices on either port 11 or 13 are able to pick up a DHCP assigned IPv4 address from that router and get internet access.

Why are any packets at all going out any ports other than 11 and 13 in this case?

What have I missed?