While it doesn't help with the root issue of enabling better logging, we were able to track the root cause of this problem down to a problem with the NTP config in the AS appliance. Because of the clock skew the Google Authenticator token was getting rejected with no useful feedback in either the logs or in the OpenVPN Connect UI.
More details are in this thread (once the moderator approves the post):
https://forums.openvpn.net/topic18623.html