Glad to be able to help.
I'm working right now but will check things out at my end this evening. I'll watch for a while and see if the problem is still there. One more thing that I didn't mention was that the error seems almost random. It's not always at the end of a round. Sometimes I'll get it 10 to 40 rejects in a row all saying unknown work. Then right back to accepted shares.
I wish I was more knowledgeable about this so I could be more help on my end. I think bgminer might come with a logging option. If it does I'll try and record something for you.
You're definitely right, there is another ongoing issue. That is that pushpool gets overloaded periodically. (a few seconds every few minutes.) I've expanded file descriptors and every single restriction I can think of to work around this, but have been unsuccessful.
So, unable to expand pushpool I ended up spinning up two pushpools and load balance them using nginx. I made that change ~6 months ago. Now we're back to one pushpool or the other getting overloaded periodically, and with the load balancing what happens is the overloaded pushpool gets removed from the balancing and you get sent to the pushpool that is still answering. If you're making a request to submit work, and that work came from the other pushpool, then the current pushpool doesn't recognize it and it gets flagged as invalid.
Oddly enough, pushpool has memcache functionality and both pushpools are pointed at the same memcache. I thought initially this was so that you could run a bunch of them and have them share the work between them, but clearly that is not the case. I'm not really sure what pushpool is using memcache for.
As you digest all this you're probably wondering why then can't I just add a third pushpool to the balancing. The problem is that in order to make sure that you always get sent to the same backend pushpool (because of the issue where your work is invalid if you don't) I had to configure the balancing to be by IP address. And, naturally, since we're behind a DDoS service, 80% of our traffic comes from... the same IP address. Ugh. So even with the two pushpools, one takes like 80% of the traffic and I have no way to split it out beyond that. I need like 3 DDoS services with each one running a pushpool behind 'em.

fairly new to litecoin, been a bitcoin fanboi since I heard about it right after the crash in '11. I'm no developer so I often just talk out of my ass, but it is in an attempt to lend my problem solving skills to the effort... I just don't always succeed!
I know CGMiner has a failswitch configuration, you can change it to round robin, etc. Maybe if you had several pools set up behind the ddos and just had people config to round robin between them?