Resolved! Source User Missing. Device has User Mappings.
I'm sure this is probably a rookie mistake, but I have to ask...
I've set up our Meraki access points to syslog to my PA500 firewall. I'm successfully getting user-id to IP address mappings (I can see them in the output of "show user ip-user-mapping
...