Sorry to insist but can you confirm that you see encrypted_keys with pywallet?
I've helped many people and even small misunderstandings can lead to a great amount of lost time
The issue is that the password that was set worked to access the smaller amount within the wallet, but not for the larger amount in the wallet.
This is not the issue
When created, the wallet file contains around a hundred keys (let's say K1, K2, K3, etc, K100)
Those keys contain keys you can see and some change keys
All are used to compute the displayed balance
When you set a password you encrypt the whole wallet with this unique password, not parts of it so all the initial keys are in there
(One problem can arise when you made around one hundred transactions after the last backup but this doesn't seem to be the case here)
Do you happen to have either the transaction number, the sending address or the receiving address of the big transfer?
Maybe you were actually hacked and this could confirm this
Also I'm confused with this sentence of yours
We were unable to use the password created on 1/1/2021 to access the larger amount that had been received back as change on 1/7. We have tried multiple combinations of passwords since. We have done the Python method, but since the password isn't working we can't access the private keys
Are you talking about the same wallet file?
As I wrote above, one wallet has exactly one password
And you say that you were 'able to access the original small change', so that would mean you know the wallet password