It's very simple: You log how much each share is worth in theory (50BTC/difficulty), and how much was actually paid for it. You can forget about fully paid shares.
If funds arrive, you pick the share with the lowest payout ratio, and pay some more for it, until another share was paid less. Then that share receives some funds, and so on. This can of course be optimized algorithmically, I'm just explaining the objective.

The least-paid shares are of course the shares of the current round. So those get paid first, until they reach the payout level of the other shares. Then, shares of older non-fully-paid rounds are considered as well, until either all shares are fully paid or there are no funds left.

As long as the pool is lucky, everything will be paid out 100%. If it is unlucky, shares will be paid by excess income from older rounds. If there are no more funds, the pool will pay that round proportionally at first. However, when it becomes lucky again, it will pay for the difference, and only start to accumulate funds again once all shares are paid their PPS value.

Assuming there are 10% withholders, this would mean that in the long term all blocks will be paid about 90% of their PPS value. That way it will hurt withholders by basically introducing a dynamically adjusting fee.

If the pool first has a lucky streak, and then an unlucky streak, and never recovers above average, the older shares will of course have been fully paid, and newer shares won't be, which one could consider unfair. Doing these calculations not on a per-share but instead on a per-user basis would not only fix that, but probably also reduce calculation effort a great deal. It will however provide some incentive to do "account hopping" after a lucky streak, as especially old accounts would be paid almost nothing while the pool's luck drops.