ESD strike breaks the LAN8742A ethernet phy
It seems that you are experiencing soft error due to ESD injection. It means that your MCU internal registers have been altered by the ESD injection. Most of the available chips in the market are already protected for 2kV ESD spikes. Large number of new chips are also have internal protection for 4kV ESD spikes.
Theoretically, with 2kV ESD you must not have any problem on your circuit.
The 48V spikes those are generated during ESD injection are also OK and even natural reaction of ESD electrical charge distribution over the internal capacitor of the ESD gun and the intrinsic capacitor of your circuit.
By the way according to your schematic I have following recommendations for you.
Based on what you have written, part of ESD current finding its way towards the GND pins, through your MCU.


read "System level ESD co-design" that is published by John Wiley and Sons.
add a dedicated GND section to your board dedicated for the connectors and ESD protection devices and connect it to the main ground plane of the card using small opening (just for supporting the return paths of the circuit).
Add an ESD protection TVS or capacitor (10nF 0603) close to your power rail connector (between 5V, 0V)
An ESD protection device is necessary for all the system I/O pins (including RJ45 Ethernet connector pins(using especial solid state bidirectional ESD protection device)) and their connection with ground must be separated by moat or whatever from the card main ground plane and have very short paths towards the GND pin of the connector.
The metallic case must not have connection/adjucency with not earthed parts of the PCB.
The correct Earth must have less than 3V AC with Neutral at the AC outlet otherwise your earth could not do its duty well.
Use "guard ring" traces those have direct connection with the main ground pin of the connector and surround the board screw holes with it and arm all of its borders with it.
Some changes in the internal firmware of the MCU are also a good practice. For example the firmware developer could follow "scrubbing" patterns. she/he could use watchdog timer and even you could add external watchdog timer to your schematics.


Good luck.