Well, the answer proved to be depressingly simple - just an absolute pig to find.
Instead of using REQUEST_URI (which gets the whole requested URL, including the querystring) I've switched to using URL (which just gets the URL without the querystring) and that seems to have utterly resolved my problems.