This is an update on my progress. Having found no solution to my plight, I emailed one of the authors, Bret Giddings. Bret responded as follows:

Try

$event->{EventID} &= 0x0000ffff;

That should bring the number into the range the MS expect. I don't know why the API returns the wrong number. Microsoft seem to correct for it in the eventviewer - I guess if I ever do any more work on the EventLog module, I should too.

This modification resolved about 95% of the weirdness. There are still some anomalies, but the script is now much more useable.

If things get any worse, I'll have to ask you to stop helping me.