Some news.
plesa - Yes, I have checked all power supplies, these are all OK. I didnt reply because this was the absolute first thing to check. No ripple, no significant noise, just nominal voltages.
I have tracked the voltages around U25 LMC662 and U27 LMC6081. This differs between mA+uA and nA ranges. On mA+uA ranges, I receive saturated rail-rail swing at the U26 AD829 output, on nA ranges, it saturates to negative supply.
IN+ on U26 is -17mVDC all the time. I receive -11.2mVDC on fully functional Keithley 6485 I lent from my colleague. I believe this is OK.
I believe that saturation is driven by the input at IN-.
On nA ranges, the U27 LMC6081 behaves strange to me. Output is -30mV all the time. IN- is at zero. When I touch the DMM probe IN+, the DMM reads some miliVolts ramping up. Starting value is random, but it ramps towards few miliVolts. No change at the output.
I used HP 3478A for reading voltages. (When I read e.g. 10VAC, it corresponds to +/14V rail-rail swing)
All is referenced to GND/Guard. The instrument has shorted Analog Output GND with chassis.
I attach the input area schematic with voltages and waveform of the rail-rail swing at the U26 output.