Here's a little more about what i found.

VFP will first look for the .dll in the startup directory. So if I have c:\ourapp and it contains the .dll, then I need not have one in c:\windows\system or on the network.
If there isn't a c:\ourapp\vfp500.dll then it looks for one in c:\windows\system.
It appears that the only time it accesses the network .dll is if you start the .exe from a network drive AND you don't have on in c:\windows\system. I.e someone must not be running the .exe locally.

On with the hunt...