We finally managed to get the answer and, as ever with coding, once we fully understood the situation the cause was obvious.
Our auto-upgrade process replaces the contents of the OSX .app A .app 'file' is just an archive/directory so it's contents can be replaced in-situ by the auto-upgrade An assets that don't match those signed will cause a signing issue
SO, just ensure the contents of the .app file matches the signed version. We had a single app version that contained an old file no longer used. As it wasn't being deleted the contents didn't match the signature.