I had a more detailed look at the fine INL data from this post
https://www.eevblog.com/forum/metrology/prema-6048-teardown/msg4655983/#msg4655983The attached graph shows the difference from the P6048 to Solatron 7081 (corrected). Vertical is difference in µV and horizontal the voltage in V.
The data seem to be recorded from positive to negative. So very likely the polarity changes at some -45 mV at the point with the jump.
However the data on the positive side of this still show quite some nonlinear effect. This indicates that there is not just a problem with the offset, but also a more gradual problem with linearity for voltages in the +-100 mV range. This part looks more like a hardware problem, not a firmware problem.
I would expect a similar shape for the part going from nagetive to positive and thus reading the small voltages with the negative relay setting. Form that it looks like the offset handling is not that bad at all.
With the nonilnearity at low voltage it only looks like the step is caused by an offest problem.
If the problem is with the ADC itself, a possible fix may be adding more offset (e.g. another 100-150 mV and thus some 50-30 K in parallel to R36) this way not use the ADC in the very low voltage range. Depending on how the polarity change is controlled (ADC reading or voltage after the offset is removed) one may still have to force it back to the same voltage and not use the full larger overlap.
Another possible cause of INL may be leakage from the reference transfer for the resistance ranges. One may be able to test if there is significant leakage there and for a test maybe disable &/ remove the link (e.g. remove R37/R38 or K13/K14 of the ADC board and add a link for a dummy 0 ref instead).