We also enforce SPDX-sourced licence tags in all our PHP code, via LicenseCommentSniff.

From a mostly AppSec perspective, I'd vote for CycloneDX. It's supported by the org I'm most familiar with (OWASP) and the tooling is far more robust, at least for now. Would it be a big deal for AppSec interests if we went with SPDX? Probably not, so I'd definitely qualify this as more of a light preference.

It looks like it's not too bad to convert from CycloneDX to SPDX, so even if we decide to go with CycloneDX we can still get the SPDX data if we want it. CycloneDX seems to have more tooling and also provides a license scanner to look at the licenses @Jdforrester-WMF was referencing.

I lean towards CycloneDX because of its broader approach, it prioritizes the management of software components and dependencies rather than license/legal compliance, which is the primary focus of SPDX.