Help diagnosing power supply fault

I'm attempting to fix an Agilent 66309D power supply.

The main (ch1) output has a problem. With no load the output regulates perfectly, flat line, exactly as programmed.

However when a load is applied even a very minimal load say 5mA the output develops a spike every 3ms that is roughly 2-3x the setpoint amplitude.

The schematic is from the service manual and is simplified, so many components are missing from the schematic, however it gives a feel for the actual circuit. Waveforms attached, any troubleshooting hints are welcome, note at one point F309 was open I have replaced it.

Note the top waveform was with a setpoint of 10V and the bottom waveform with a setpoint of 5V, however the waveforms are the same just the amplitude changes

I had a similar problem on a 66312A, but mine had the pulses without any load applied as well. At power on the internal fan would speed up as a result of this problem.

I traced it to an open feedback capacitor (10 pF) in the voltage control loop as shown.

You may have a problem in the current loop as they are very similar.

I did some more testing, I'm a bit closer but not solved yet...

1) With no load the output is perfectly regulated and the opamp power supply rails are clean
2) With load (any load more than about 5ma) the output contains spikes every 3ms, each spike is a burst is about 10 cycles at 400kHz
3) I isolated the output regulator gate drive signal (lifted U309A-1) and used a lab supply to drive this and the output is clean and controllable under load.
4) With U309A driving Q303, the noise burst seen in the output is also present in the OP amp rails, so I believe the opamp power supply is the root cause. The block diagram refers to this supply as a gated bias +/-15V supply (it gets disabled when the output is disabled). With no load the rails are clean and hence the output is clean.

The gated supply appears to be this circuit:
The SGND voltage changes based on the output voltage, not sure if this is by design so the opamp rails move up as the setpoint does or if there is a short from the output to the SGND node??

The pin numbers for J307 don't match the actual circuit so this makes even less clear. It appears that the negative rail is too close (voltage wise) when loaded to the setpoint value at U309A-1 and this is what causes the noise burst.

Thoughts?