With some help and suggestions from this thread, I've tracked this down to user error.
The epub I was looking at, a Calibre converted Kindle book, had the following spread through the css:
font-family: "Times New Roman", "serif";
Removing those and all is good! I had thought that I was looking at the font specified in my default.css when I was actually looking at the default T1 font, and for this reason had thought that my default.css was working as expected.
Calibre has a option under Look & Feel/Filter Style Information to remove font style information. I haven't tried that yet, but suspect it would have helped.
A quick look through my library shows 139 books out of 462 have a font-family:
reference. A number of these are just font-family: Serif
so I can ignore them, but there are a number I'll go and have a further peek at.
I guess there must be a CSS way to override something like font-family: "Times New Roman"
? More ideally, I'm looking for something that can say "if there's no embedded font, then override the font". For example, I wouldn't want to override the Fontin font in Jelby's Three Men in a Boat