In regard to the Winbond flash we had issues that has shown the same behavior like your case.
The root cause in our case was the "security register" called region in the flash which resides above the 16 MB address range and
has a size of 0x300 bytes (on W25Q128FV for example). The original flash contents on the CRB contains some data
in that region and we were only able to boot the CRB after re-flashing if this region was transferred to the new flash completely.
To do so, you must tweak BeeProg a bit, there are special options to erase and program this security registers.