Thanks for speedy reply @SpaceMonkey! -Yes, we're running PHP v7, and I've made a few changes to cookies etc... but have changed them back/tried various options. I thought the PCI changes by WP would be a red herring but seemed so coincidental! I'm sure I read a post at some stage in the past regarding PHP config changes that needed to be made with v7, which I made (but didn't document - doh!) to do with redirects, and I wondered whether that may be an issue, although a bit flummoxed as it was all working...
If you do have a later version I'd certainly give it a go as I'm running out of ideas!
Cheers