Perhaps you want to inject small stimuli at each node, or each
node with a significant plate area or wire length, and gauge the
response. I have done this for debugging other sorts of
misbehavior. you can make voltage sources with their values
being complex expressions - e.g. ampl=rf_ampl*(rf_node=123) -
and propertize each source (I might recommend you work with
sinusoid current sources that start after delay, so the DC
solution is not whacked) with its unique node assignment,
and index the "pointer" variable in Parametric Analysis (for
Cadence; an alter command, in other SPICEs?). Then you
run the rack of sources and plot the results overlaid, any
sensitive nodes will jump right out at you.
However I have yet to see any mention of the simplest and
most basic thing - scope traces of all the involved pins
(VIN, SHDN, GND, FB, VREF if available) at a timebase about
10X the RF period and 10X the RF envelope period. Until you
know this is or is not a conducted-susceptibility problem,
you don't know whether to look inside the IC or outside for
the solution. The output pin is most likely (but not necessarily
exclusively) a result; you have to identify the input.