Revisited this recently, it was indeed the virus scanner messing with my network traffic.
I'm using Sophos, and found that if I add the address of the machine hosting my Flask application to the virus scanner's "allowed sites" list then my SSE events are received correctly.