I thought I would add some closure, or maybe non-closure-giving-up to this.
I spent some time with grep and the command language and found the log entries in APCC for every motion command sent during a couple of these events. The commands in there corresponded to the guide pulses from the PHD2 log, and were correct -- the only large ones were reactive to the excursion, not the cause of the excursion.
Since everything connects to ASCOM which connects to APCC, nothing else could have commanded the mount to move without appearing in that log (there is no handheld).
I went back and reviewed security footage again, more carefully. It's very dark and vague, but I really think I would see a bird, and that's about the only thing I can think that would be out and might touch the mount. Nothing.
I set up the again last night with the same setup exactly. I had intended to switch to the C11, but thought I would try the same setup again. It guided normally, and fine. Seeing was still mediocre, but no excursions, imaged all night, perfect round stars. Not great guiding, but what I expected given the seeing (I ran guiding assistant first for a good while to see how well it saw).
Tonight I put the C11 on, and it is more or less normal. It is slightly windy tonight and seeing is still bad. There are some larger excursions but most are under 1", two were over 2" but even with light wind with that big dew shield that could well be a puff of wind.
So the problem seems gone. Or in hiding.
Maybe I need a better camera to watch the telescope. Everything else I've checked is a dead end. But I will remain happy so long as it stays in hiding. If anyone has other things to check, let me know, otherwise guiding, imaging and happy.