Hi,
Well, first of all, Q103 and Q127 are not the culprits... I removed them altogether, and it didn't change the behavior whatsoever...
Spot heating components didn't bring up any conclusion, maybe because after it hits about 0.58V it stays there so, there's no room to see it worsening... This already smells like the source voltage of the leakage, whatever it is, is around that value (and not that it's being "clamped" at that level).
Spot cooling components, didn't help either, I tried cooling one by one all the multiplexer FETs, U102 (AD542 dated 8429), U101 (the bootstrap/ guadring buffer)... Of course that, at times, when I cooled them too much it would go all over the shop... but then I cannot rule-out some condensation. Everytime I cooled them carefully, I couldn't see anything outstanding.
But one thing did make A LOT of difference.
I lifted the input side of R107 and two things happened:
1. Leaving it opened, the build up voltage slowed down more than 20~30 times. Especially past 0.3V (granted, maybe this slowing down past 0.3V was already there, but since it was going relatively fast before, I didn't notice).
2. When I connect the 10Mohm resistor directly at the tip of R107 to ground, it still shows a predominantly positive voltage, but it visually averages at much lower levels, (most of the times the display is showing values around 100uV).
Both of those above can be very well from U102, but I would be very happy with that already.
With R107 disconnected as it is, it leaves very little (component wise) as possible culprits.
a. The P.C.B. (surface contamination under the switches because everywhere else is quite clean).
b. The Switches themselves - most likely -

.
c. Leakage from the relays coil to the contacts (I know, very unlikely, but easy to rule-out at least).
d. A handful of range switching FETs connected after the 10Mohm resistor. Again very unlikely because there's no positive voltage there for the leak to come from (only negative voltages at the gates, at least in DCV ranges).
Other than that, I can only think of RFI rectification, that is finding its way into C109... but from what is left of components, who would be the one rectifying? The switch contacts? The FETs?
On that hipothesis... I wonder if it would help to add a ferrite bead at R106 and R107 leads?
More to come... I`ll let all know.
Thanks for the insights so far.