OK it looks like we're narrowing this down to an issue with our firewall IDP features that is blocking Moodle posts and updates, believing them to be attempted "injection" attacks.
I've read http://docs.moodle.org/dev/Security:SQL_injection but given this is occurring with standard moodle modules in forums and glossaries the Dev guidelines don't really apply.
I'll look at taking this up in a different forum on Moodle (security probably) and also discussing with our firewall providers.
Thanks