The ACF at each lag with the same denominator throughout, which is what keeps the estimated sequence positive semi-definite – dividing by the number of terms actually summed at each lag does not, and produces "autocorrelations" no stationary process could have.
Details
The white-noise bands are a per-lag test, so about one spike in 20 will cross them by chance. Read the Ljung-Box statistic, which tests all lags jointly. After fitting a model, subtract the degrees of freedom it consumed before interpreting either.
