Just to add from Wireshark it seems the initial request is to the pub which replies back with the IP address of the EM Servers
http://x.x.x.x:8080/ccmcip/getservicesmenu.jsp
Can you run the above service on multiple Servers?
Alternatively has anyone used the setting below
IP Phone Proxy Address:
This parameter specifies a proxy server name or address and port (for example, proxy.cisco.com:8080). If the proxy server is specified, the Cisco IP Phones use it to request all URLs. Leave this setting blank for the phones to attempt to connect directly to all URLs. If a name is used instead of an IP address, configure phones with valid DNS servers to allow name to IP resolution. Confirm that the proxy server is listening at the destination that is specified.
It looks like you can make use of this URL in the way I would want to however when I tired it it failed. I deleted the URL services and added the proxy address but when pressing the service keys nothing happened, added the url back again it worked so I probably did something wrong?