Fair enough - here's a top view of the board as it's sitting on my bench. All the I/Os have an LC filter (a ferrite and a 100 pF or 1nF capacitor depending on the speed), with the exception of the programming header (it's labeled 'J14 STDC', to the right and bottom of the micro). You can also see the 'RESET' push button switch. In the final application, it will have a shielding cover over most of the board but that's been removed during development.
During development, it's in a relatively benign environment (except for the occasional 'nearby' ESD zap). There aren't any high currents flowing nearby. All of the reset events I've seen so far have always been triggered by ESD in the vicinity (about 1 meter away).
Other things of note:
1. The STM32 gets its clock from an 8 MHz oscillator, not a crystal.
2. STM32 runs on 3.3V from an AZ1117IH-3.3 LDO that converts down from 5V.
3. The 5V comes from an LTC4413 'ideal diode' that ORs power from two independent 5V sources, both of which are active.
4. Same behavior seen on multiple copies of the board, so it's unlikely to be due to a flaky solder joint or other assembly errors.