Have you turned off HP Sure Start in the BIOS setting when running the OEM firmware (in "Security->BIOS Integrity Checking")? There's a PEI and bootblock volume in the EC chip, which Sure Start may use to recover the BIOS.
The only thing I can think of would be the Embedded Controller. Unfortunately there isnt a lot of documentation on how the EC could cause these problems nor are there any hints towards how to potentially integrate them into the build. I have found that the EC is an MEC1322 which is a part of the chrome-ec project and was wondering if there may be an easy way to do this integration to further test.