The rewrites aren't there for providing canonical versions of zen cart pages. They don't appear to be causing the problem - I've tried disabling them and the problem persists.

I'm not using any SEO URL modules.

Can you confirm my understanding that these URL's are supposed to be generated based on the HTTPS_SERVER value in configure.php?