...
I went and reprocessed, with brand new code witten by me from scratch in KanoDB, all the shares from the start of October for a few months of data, to make sure there wasn't some other new bug in ckpool, and found no blocks missing from the known ones in the data.
Thus, unless someone was withholding, it would appear that October was simply just bad luck.
However, to ensure that continues to be the case, I removed the largest miner that was part of that 200PHs - rental - from the pool, since for rental, withholding blocks is to their financial advantage. As I've mentioned before, most people don't mind being involved in altcoin scams, so why would rental people mind doing something scammy?

I looked through the threads on withholding blocks, and I see that you cannot "steal" a block, because its not useful anywhere else, but I still can't understand why it is advantageous for anyone to withhold a block.
What about the miners and the firmware version? Could that have an effect on finding a block?
Is there a test pool that you can point your miner too that has ridiculous low difficulty just to make sure it is capable of generating blocks?