After many Google searches I've finally found the answer to this.

For anyone else that might have this problem, it is a bug in the chip itself as described in ENC28J60 Rev. B7 Silicon Errata. This bug is present on chips where EREVID=00000110.

Sometimes, when ERXST or ERXND is written to, the exact value, 0000h, is stored in the Internal Receive Write Pointer instead of the ERXST address.

Work around
Use the lower segment of the buffer memory for the receive buffer, starting at address 0000h. For example, use the range (0000h to n) for the receive buffer, and ((n + 1) – 8191) for the transmit buffer.