I have a one bit that might be useful that I learned from debugging/optimizing Emacs.

macOS' Instruments tool only checks for leaks when it can track allocations and it is limited to ~256 stack depth. For recursive calls or very deep stacks (Emacs) some allocations aren't tracked and only after setting malloc history flags [0] I started seeing some results (and leaks).

Another place I'm investigating (for Emacs) is that AppKit lifecycle doesn't actually align with Emacs lifecycle and so leaks are happening on the AppKit and that has ZERO to do with application. Seems that problem manifests mostly on a high end specs (multiple HiDPI displays with high variable refresh rate, powerful chip etc.)

Probably nothing you haven't investigated yet, but it is similar to the ghost (pun intended) I've been looking for.

[0]: https://developer.apple.com/library/archive/documentation/Pe...