My mistake about who triggers the 404 - I must have looked in the next line for the user agent.
Nevertheless the errors are still there triggered from non-bots. Here's a representative error from the apache log

Code:
198.241.217.15 - - [29/Apr/2013:20:02:43 -0400] "GET /index.php?main_page=product_info&products_id=1145 HTTP/1.1" 404 36785 "http://MYSITE/index.php?main_page=product_info&cPath=64&products_id=1145&zenid=f31648d257b3a7eb6aa129dee97fcb31" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0"
The way I tracked it down was by looking at the source code of the referring url (in blue) and the only place where the url which triggers the error was in the canonical link in the head. And of course, I double checked that a browser (tested in chrome, firefox & safari) is happy with http://MYSITE/index.php?main_page=product_info&products_id=1145 (gets to the correct product) and unhappy with http://MYSITE/index.php?main_page=product_info&products_id=1145 (404 and zen cart returns 'product not found').