Most likely, all the JAX-WS implementations have some sort of proprietary API that can be used to create services that would use their specific implementation and bypass the JAX-WS provider discovery mechanisms. In most cases, the discovered Providers are likely a wrapper onto those API's.
For CXF on the client side, that would be the JaxWsProxyFactoryBean:
http://cxf.apache.org/javadoc/latest/org/apache/cxf/jaxws/JaxWsProxyFactoryBean.html
which can be used to create the Proxy objects from the JAX-WS generated interfaces.