It took some time for USPS to deliver the replacements, but I got them in, swapped parts... and it's still broken. So I checked with the thermal camera again, no outliers (though CA3140s are power hungry!), and probed around some more. I've isolated it to the first reference PLL (not the quadrature PLL or the off-the-main board PLL) by pulling the chip and board, respectively, so I reflowed every pad in the physical area of that first PLL (two rows of ICs with the surrounding passives) - no change.
So I probed around some more, using the quadrature PLL as an apples-to-different-kind-of-apples comparison, and I narrowed things down. The fault I'm seeing looks somewhat like switching of the triangle wave (pin 4 of U309), where it will be stable and will change frequency appropriately, but when the unlock light goes off, you see a vertical artifact - it looks almost like you switch from one triangle wave to another mid waveform, but only briefly. Farther upstream, at pin 6 of U308 (Vvco), you can see normal adjustment pulses, a couple volts or so excursions from a fixed offset, but then when the unlock light is on, sometimes there are brief pulses that rail to the positive rail, a behavior that doesn't exist in the quadrature VCO. I've checked the other ends of the Vvco connection, and while the same signal is apparent on the near side of the resistor, it's not present past it, so it is being generated by this PLL. I've also replaced virtually every IC in the loop, save U306, the PLL controller, since it looked like its output is normal, but I suppose it's the next suspect even though at a glance, its output is normal and it starts looking strange at U308. U308, U307, U311, U310, U309, U314, U315, and U312 have all been socketed and replaced, testing with other pulled and new ICs along the way. The small holes on the board make IC extraction really timely, so it's been an annoying slog so far.
So I'm truly baffled. It's still intermittent and brief, so I don't know how a passive or a short could do it. It doesn't change pressing on any part or flexing the board, so I don't think it's a cracked trace. I've replaced almost every active part and checked the pins talking to other portions of the board and ruled them out. I've monitored the rails for noise, abnormality, or intermittent issues and seen nothing.
I suppose in making this post, I've just convinced myself to swap U306 because it's the last active part in the loop, but at least without time correlating inputs and outputs (I don't remember if I did this with the quadrature loop or this one in the past, but I know I've done a little), maybe there's something about the timing of its normal switching behavior that's resulting in wonky outputs of U307 which is quickly discharging the capacitors generating the triangle wave.