We need to know more how the different earths and commons relate to each other.
For instance, does the shield earth connects to 5v common? I not where does it return? And I assume that you are using a non-isolated buck, such that the 24v and 5v commons are the same?
Is there another earth, like chassis earth?
How tho they relate? Do they have capacitors and/or inductors to couple them?
How does the CAN transceiver fail? A short or leakage on any of its pins, or is it a functional failure (i.e. the device talks but not listens).
Was the unit requires to be powered up for failures to occur? If powered up, does the device start getting warm after the strike?
The 1.1Kv surge requires clarification also......to which regulatory standard are you testing? What is the impulse waveform characteristics?
Other thought...have you sent the device to the IC vendor for analysis, to see which section is damaged?