My suggestion would be that rather than considering 200 vs 404 implications, when in doubt just 302/307 to a page that gives as much sanitized non-sensitive debug output as possible or at very least a unique identifier so that customer support can look up the transaction. The 30x will not be cached for long by a CDN or search engine and will be retried later vs. being cached a long time as a 200 or removed from caches/search engines for being a 404.
If one did not mind bending the RFC's a bit they could even put the unique transaction identifier in the 302/307 for easy viewing from the client.