Stm32 options bytes get randomly reprogrammed even when flash not unlocked

[CSeto.1]

I have a strange issue with my Stm32F767 project. We've seen with some boards randomly RDP will be enable to level 1, and BOOT0/1 are set to 0xffff. ESD seems like a potentially likely cause, but is there really enough energy in an ESD event to cause a flash erase to occur (given that the option byte bits are getting SET, not cleared, which implies a flash erase must have occurred). When this happens, the boards are recoverable with the removal of RDP back to level 0, and a reflash of the code.

We have two separate boards with this exact same chip and general layout, and we've only ever seen it with one of the two.

One other thing of note, when the board boots up, I check that the option byte word containing the RDP/brownout setting is correctly set. If it is not, I set the brownout protection to maximally restrictive with the following code. Is there any obvious issue with this code? The board is released from reset after programming and allowed to change its option bytes with this function. This function should never unlock the option bytes after that unless they change.

static void CheckProgramOptionBytes(void)
{
  uint32_t current_options_word;
  uint32_t desired_options;
 
  // Set desired options
  desired_options = 0;
 
  // Ref: RM0410, Page 113, 3.7.6, Flash option control register (FLASH_OPTCR)
  desired_options |= (0x01 << 31);  // IWDG_STOP: IWDG counter active in STOP mode
  desired_options |= (0x01 << 30);  // IWDG_STDBY: IWDG counter active in standby mode
  desired_options |= (0x01 << 29);  // nDBANK: The Flash user area is seen as a single bank with 256 bits read access
  desired_options |= (0x01 << 28);  // nDBOOT: Dual Boot disabled
  desired_options |= (0xfff << 16); // nWRP: No write protection for any banks
  desired_options |= (0xaa << 8);   // No read out protection
  desired_options |= (0x01 << 7);   // nRST_STDBY: No reset generated
  desired_options |= (0x01 << 6);   // nRST_STOP: No reset generated
  desired_options |= (0x01 << 5);   // IWDG_SW:
  desired_options |= (0x01 << 4);   // WWDG_SW: Hardware window watchdog
  desired_options |= (0x00 << 2);   // BOR level 3
 
  // Get current options
  current_options_word = FLASH->OPTCR & ~(0x03);
 
  if (current_options_word != desired_options)
  {
    LOG_W(TAG, "Option bytes not set, setting them...");
 
    // Unlock option bytes
    HAL_FLASH_OB_Unlock();
 
    // Set desired options
    FLASH->OPTCR = desired_options;
 
    // Commit options
    if (HAL_FLASH_OB_Launch() != HAL_OK)
    {
      LOG_E(TAG, "Could not set option bytes (failed to launch)");
      return;
    }
 
    // Relock option bytes
    HAL_FLASH_OB_Lock();
 
    // Reset
    LOG_I(TAG, "Option bytes set, rebooting...");
    HAL_NVIC_SystemReset();
  }
}

Thanks!