well that was quicker than expected, shoutout to the aeotec.freshdesk.com support team, I put in a ticket and received a response in less than 12 hours
they recommended excluding the device and re-pairing it closer to the z-stick, I was dubious as I had already done this twice, within 5 feet of the z-stick
I excluded the device, factory reset it for good measure, and re-paired it using the pin, placing it within a few inches of the z-stick
and lo and behold, it works now, no more messages about discard commands because they were received at a lower security level than expected
so hope this helps, as it seems commonly with z-wave, the answer is to bang your head against the wall until it works