I may have found the solution to this...

It seems the SQL Agent Service Account may need the "Replace a Process Level Token" right. Seeing as the domain is locked down, I've requested they "clone" the GPOs that are applying to the existing (working) system to the new system. Failing that, I'll ask them to configure a GPO to do this.

Further updates (and hoepfully the solution) as the situation warrants.

😉

Jason