BTW, for what it is worth, I had a play with IWS and ClickOnce today... careful not to break the existing setup, I managed to create a test version to deploy, which contained the items we usually use - e.g. some custom ring tones, a corporate directory XML, SipEndPoint, GAS, WebModule and some other bits.
In this version I modified the sip config to limit to specific ports (16xxx to 32xxx) which are the ones preferred on the QoS settings on the network / WAN.
I also added the option for honor_first_codec='1' as we do see random 1-way speech which could well be codec negotiation related.
I managed to deploy this to my test PC and it appears to be working...

I couldn't begin to roll out to contact centres since we were suffering random issues with slow delivery of Agent Scripts - so it is unwise to "play" whilst the environment is unstable - but I may begin rollout to a select handful of users for broader testing later this week.
Thanks again for everyone's help.
BTW - these issues came to the fore when our provider upgraded SBC last weekend (Acme Net-Net) to a later firmware, and suddenly we see an awful lot of disconnections, silent calls, calls which don't disconnect (SIP server not seeing the BYE) and somehow even our outbound CLI is broken as well. A week of issues, you could say...

SBC couldn't even be rolled back, and the HA pair fell over completed with kernel errors too... sounds like a bad firmware

But this is why we also noticed that some traffic is outside of the ranges, and hence why I wanted to make this change. Sorry for going off track, but wanted to give some background.
