Why am I seeing a 404 for a default domain? I don't even have a default domain.

Swarm does not know there is not a default domain until it asks, since it is just a stream.  It will cache the 404 for a time to speed performance and not fills the logs with 404s, but when the cache.realmStaleTimeout (realmCacheStaleTimeout) is hit, the next read will try again and get a new 404.  You can safely ignore these in your log.