(1) is my assumption about public IP correct, and this wouldn't show up in the cloudwatch logs due to that?

No, your assumption is wrong. If you capture all (rejected and accepted) traffic then traffic to and from your public IP entering and leaving your VPC will be logged.

(2) are there any other things I could check in terms of logs?

Nothing springs to mind - your VPC flow logs are key here and should tell you where to look next.