OK. So this is a weird and complicated bug... but let me share out of interest.
The old system had the IP address as a binary integer/blob thing. It had a maximum size, and it was used as part of the authentication / logging routines. The old code was ugly and inefficient... which is why I changed to LUA.
In the new system, I just replaced the functionality, without realising I was now using a string. When I initially cutover, it was OK. The old database server was ignoring the longer string elements, but things were working.
After cutover of the website, it included modernisation of the database layer. It threw errors whenever there were inputs that exceeded field size. I found and fixed that in the function. But later, I found another problem where a field in the database was also bigger than the maximum it would see on input. (This is the most recent issue). That is also now fixed.
Sorry for the inconvenience... but we should be good from here on.