The only thing I can see wrong with your config is that some of your ports are still set to PVID 1.
I'm coming from a world where I manage Dell Powerconnect switches. In Dell CLI parlance (and I think Cisco is similar), there are two main switchport modes, access, and trunk. Setting a switchport to access with the command "switchport access vlan 44" tells the switch to tag any incoming traffic on that port with VLAN 44, and to send any traffic on VLAN 44 out of that port, removing the tag in the process. In reality it's a bit more than that, since it is, after all, a switch, and learns MAC addresses, thereby avoiding sending all VLAN 44 traffic over all VLAN 44 ports. But let's ignore that for now.
So, to mirror that behavior on the TP-LINK switch, you need to set the port as an untagged member in VLAN 44, but you also need to set the PVID to 44. The reason for this, as I understand it, is that the untagged setting tells the switch to send VLAN44 out of the port, but it doesn't tell it what to do with incoming untagged traffic. That's what the PVID setting does. For a port with PVID 44, any incoming traffic that's not already tagged with a VLAN ID will get tagged with 44. (someone correct me if I'm wrong on this, please).
The other mode on the Dell switch is trunk. This is used in a situation where we want to send traffic with VLAN tags intact, so that the device on the other end can handle the VLANs. That device could be anything: a pfsense router with multiple VLAN interfaces, another switch, whatever. In that case, we set the port with "switchport trunk allowed vlan add 44" and "switchport trunk allowed vlan add 11". (I'm using my own VLAN IDs here, obviously). So, that works in the case where all the traffic on the port is tagged. But what if we want to handle untagged traffic on a trunk port as well? In that case, we also set "switchport trunk native vlan 15" and then any untagged ingress traffic will get VLAN ID 15. [EDIT: and egress traffic for VLAN 15 would be sent over the port as well, untagged.] That's roughly equivalent to the PVID setting on the TP-LINK switch. That comes in handy in the case of a device like the Ubiquiti AP, where the management network is untagged, but the SSIDs handle tagged traffic in different VLANs than the management network.
To mirror the trunk allowed setting on the TP-LINK switch, you just need to set the port as a tagged member of whichever VLANs you want to trunk. The PVID will still be in place, and will handle any untagged traffic coming into the port, if there is any. The PVID setting comes in handy again for devices like the Ubiquiti AP. My own has its management interface in VLAN44 and also serves an SSID in that VLAN. So the port it's connected to is untagged 44 and PVID 44. But it also serves an SSID in VLAN 11, so the port is also set to tag VLAN 11. That's port 4 in the screenshots I've posted.
I've checked with ntopng and also with tcpdump and I don't see any untoward traffic on any of my interfaces.