We've done a bit more investigation and tracked the source of problem 2 down to ApplicationMenuAutomationPeer. It looks like GetChildrenCore just iterates around the Items collection and tries to cast to UIElement, but in this scenario the Items collection contains VM objects and the MenuItems are created by the ItemContainerGenerator. Looking at the implementation of System.Windows.Automation.Peers.UIElementAutomationPeer, it actually uses VisualTreeHelper to walk the tree instead of using Items.
We have a workaround by creating derived classes from ApplicationMenu & ApplicationMenuAutomationPeer and walking the visual tree to create the child peers. This doesn't fix the QAT problem, but I would guess maybe something somewhere is doing a similar UIElement cast.