The issue is potentially as Dmitry Grigoryev says, that some powered hubs "back power" the host.
I tried first using a schottkey diode between the power to the hub and the hub but this didn't help. I decided to see what happened with the red removed altogether. This still didn't help either.
I can't recall all the details off the top of my head but part of how USB works involves the hub pulling up USB data lines at times and it seems this is either enough to allow a voltage to then leak back to the power rails the RPi PMIC is checking, or that the problem is in fact slightly different and somehow caused by the presence of a USB hub at boot confusing the bootloader.
In either case the solution I came up with was a simple modification to the hub using a few bits out the parts bin and 10 minutes with the soldering iron.
- an NPN transistor,
- a P channel MOSFET (grossly over-rated at 61 Amps, but that's what I had to hand)
- and a couple of 4k7 resistors.
The VBus signal (red wire) from the host connects to the base of the transistor via a 4k7 resistor. The Emitter is connected to GND (black wire from host). The Source of the FET connects to the external power source in (which is isolated from the hub), and the Drain to the hubs power rail. The collector of the transistor is connected to the gate of the FET such that it is pulled down when the host provides power, thus switching on the FET and powering the hub. The remaining 4k7 resistor between the Power source and the gate prevents it floating around. Finally I put the Schottky diode back in place such that the hub can still be used without external power.
My rpi4 now boots perfectly every time (from LAN) and with a USB DVD drive connected, something the previous rpi3 wouldn't do.