Terry Lundie-Jenkins replied
Found the issue and its something to pin up on the baord as not the norm ..... Basically MOD SECURITY acted on a false positive at our host level and quarantined admin-ajax.php
Once that was sorted we did find a plugin with some bad scripting and killed it.
Thank you for your time on this - case closed and sit humming along again : )