In most applications, it is acceptable for there to be temporary non-functionality in case of ESD events, so long as normal operation is resumed after the event. If this is the case with your application, then we recommend modifying the watchdog reset as follows:-
If a watchdog reset event has happened then you can make no assumptions about the current state of the chip - that is the point of the watchdog. You do not even know if the device address register contents accurately reflect the DA assigned to you by the host. Therefore to be sure of operating properly with the host, you need to simulate a disconnect/reconnect event (with the enCore turn off and on the Vreg; other M8 family can use an GPIO to control an external switch; hub applications may force a SE0 upstream for a period of aproximately 100ms). This is not specifically allowed for by the USB spec, but nor is it prohibited; you may be reassured to know that several of our largest keyboard customers adopt this approach.
After the reconnect the host will send a bus reset, and with careful coding your firmware will once again start running correctly.
I hope that your ESD spec allows you to use this technique- we believe it to be very robust; if not, then we have to try to fix the root cause.