An obvious candidate would be zsync, since it's not out of question that Lua might be doing something dumb when trying to find a "zsync" something in its package path...
Which begs another question: if you have shell access, and with the libcurl in place, does running zsync2 actually work?
EDIT: FWIW, just ran a strace on a full vanilla install on a PW2, and it's not touching a hair of libcurl ^^. The old PB SDK *was* shipping libcurl, though (as well as a lot of other random crap).
EDITē: But looking at the searchpath order in the strace, it's conceivable that something could be loaded from outside KOReader... Something that could conceivably depend on libcurl, and blow up when it gets fed our own instead of the one it expects...
strace -fitv -e trace=file ./reader.lua /whatever/the/startup/path/is/on/pb would help
.