No replies to this... but here is an update that might help someone else.
The enumeration problem was I had D+ and D- reversed - Doh! Once that was fixed the hub enumerates just fine.
However I still have this strange 500Hz square wave on the PWR and TEST pins. And I just discovered the GANG pin does it as well. And it happens when the port is not in standby.
So when the port is in standby, the GANG pin is low.
When the port is active, the GANG pin oscillates at 500Hz, and so does the PWR and TEST pins.