Quoted from Schwaggs:A place where random shorts can occur that will blow out switch matrix components is the lane change switch (next to the flipper OES) and the pop bumper scoring switches. The lane change switch can put 28V solenoid voltage into the switch matrix and the pop bumpers scoring switches can ground out to the special switch inputs and/or short the switch matrix to the lamp matrix (all these voltages are in that area).
Carefully inspect these switches and ensure the proper insulating papers and spacers are in place.
I have had the same issue the OP is describing and was caused exactly by the lane change switch at the flipper EOS pushing 28v through the matrix. I also had a different machine pop the switch matrix when a nearby switch wire broken loose and shorted to a pop coil pushing high volts to the matrix.
Beast to find, being a proximity thing randomly happening during games, and is only takes a touch while flipping away, & causes the blown matrix with seemingly random target hits or pops - plus can be 1 play or dozens between incidents.
Of course, it could be a playfield switch against a pop coil too - but your pics don't show that and you've said you rebuilt the pops and flippers - but is there a switch "almost" touching coil voltage - that might vibrate to a contact position during play???
If you had another few parts to burn, I'd say glass-off, toss the ball around not using the flippers, to try an isolate an EOS switch.