Hi, David. I'm searching the forums with a similar issue. I think I can help you a bit.
It seems like you actually need 2 PIDs, one for the bootloader, and one for normal code execution. I'm not sure why they need to enumerate as 2 different devices, I've searched a fair bit and haven't been able to find an answer.
I've been able to change the VID/PID for normal code execution by creating a custom board package and changing boards.txt, as well as USBCore.cpp. I followed this really excellent tutorial, which also has a discussion further down in the comments about VID/PID and drivers, and links to a good Adafruit tutorial on driver creation and signing:
https://forum.arduino.cc/index.php?topic=409715.0
Yes, I guess there's a generic CDC inf file for Windows 10, but for anything under, you'll need to create your own that points to usbser.sys. And it's helpful to sign it, especially if distributing it to others. The adafruit tutorial on driver signing is a little out of date - I went with GlobalSign and I guess as of last year, they don't allow downloads of code signing certificates. Now it's all hardware-token-controlled, so they have to send you a USB stick. The adafruit tutorial was still extremely helpful, but to install the certificate, you end up following these instructions (even though it's not an EV cert):
Doing all of that, I was able to successfully change the VID/PID, create a driver, and have my board recognized on a Windows 7 machine. Woot! However, I'm still having trouble with the bootloader. I only have one PID and tried using the same one for both the bootloader and "normal" port, but it's not working. I was able to re-compile and re-burn the bootloader, and although it did enumerate as a COM port, it didn't associate with my board and I wasn't able to re-program through the bootloader.
I'm wondering if getting another PID, and adding it to my driver will fix everything. And I'm still curious as to why the bootloader needs to be identified as a completely different USB device.