Kept doing some work on this. Our final correlation has been that clients with Internet access work great, those without (which we have a bunch of) are constantly having problems.
Configured a proxy and configured a couple of the clients to point at it, the VMRC plugin begins to work! Checked out the logs and found GET requests to: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Seems that the file is a master list of trusted CA's. Either way, getting that file pulled in from the internet seems to make the client work. VMware Support hasn't confirmed that this is a fix (nor that the client needs Internet access anyway) but I'm hoping to hear back soon.