String encoding during page render

Question

I am experiencing an odd problem as the page is being rendered in the browser, or so it seems.

In the Model I have

public string ReviewWrapperUrl
{
    get
    {
        string returnurl = Settings.SiteSettings.SiteRoot + Settings.PowerReviewSettings.CCReviewWrapperUrl + PageID;
        if (!string.IsNullOrEmpty(Year))
        {
            returnurl = returnurl + "&pr_page_id_variant=" + Year;
        }
        return returnurl;
    }
}

At this point returnurl holds a value like http://www.mydomain.co.uk/write-a-review?page_id=191519&pr_page_id_variant=2018

In the cshtml I have:

<script>
    try {

        POWERREVIEWS.display.render({
            api_key: "@Model.PowerReviewAPIKey",
            locale: "en_GB",
            merchant_group_id: "@Model.PowerReviewMerchantGroupID",
            merchant_id: "@Model.PowerReviewMerchantID",
            page_id: "@Model.PageID",
            review_wrapper_url: "@Model.ReviewWrapperUrl",
            components: {
                ReviewSnippet: 'pr-reviewsnippet',
                ReviewImageDisplay: 'pr-reviewimagedisplay',
                ReviewDisplay: 'pr-reviewdisplay'
            }
        });
    } catch (e) {
        window.console && window.console.log(e);
    }
</script>

If I put a breakpoint on review_wrapper_url: "@Model.ReviewWrapperUrl", the value is the same.

Here is where is get more complicated. The powerreviews plugin then renders to the browser. However by the time it is rendered the string has somehow been encoded. The & in page_id=191519&pr_page_id_variant=2018 has changed to & and this is causing me problems because the plugin on the target page is using & as a delimiter.

I have spoken to Power Reviews and they have tried the same values and cannot replicate the problem. One of their developers that knows a little c#/APSX has suggested it could be that .NET is somehow converting it as its being rendered.

However the final URL has been appended with more parameters by the Power Review plugin which are not affected.

http://www.mydomain.co.uk/write-a-review?page_id=191519&pr_page_id_variant=2018&pr_merchant_id=xxxxxx&pr_api_key=xxx-xxxx-xxx-xxxx-xxxxxxxxx&pr_merchant_group_id=xxxxx

Has anyone experienced this? Suggest ways for me to prove or disprove processes that may be causing it?