Thanks all - got it all sorted and am currently sifting through CAN data.
It was a combination of not sending HEX commands (rather than ASCII) over the USB Serial, relying on service manual docs rather than physically inspecting the layout of connector pins in the car, and needing to set the 500k baud rate for the bus.
@Xag - we're capturing it in hex using CoolTerm, then doing pattern recognition through a few of our own scripts as well as using some online plagiarism checkers.
The same tools that you can use to compare essays and identify common segments of text work well for this type of analysis. Capture one session as a baseline, then another session performing the action you want to track. Use the tools to identify common segments and ignore those - the differences are where you can then look in more detail for specific codes.
As input I am now using the json format for the logfile. I am using TextWrangler on the Mac to sort lines and filter out duplicate lines. Filtering duplicate lines can of course only be done by first deleting the timestamp column, I do that in Excel. Still a bit clumsy but it works.