The /PHANTOM jumper on the ZCB just allows the ZCB to assert /PHANTOM for its onboard ROMs. This is the opposite of what you want to do. While the 2716 is restricted to exactly 2KB max size, as you've concluded, the ZCB has multiple 2716 sockets. This results in the ZCB responding to, IIRC, 0xE000 - 0xFFFF if it is jumpered for 2716 operation. Even if there is no ROM in the socket, the bus drivers will activate and push whatever random state they're at onto the bus (hence, the 1A 1A 1A...).
If you place the board set in a NorthStar motherboard with built-in serial ports, there will probably be bus contention between the onboard port(s) and the serial port on the ZCB. This could, in the worst case, result in blown bus drivers when you try and read from both ports at once. In any case, it probably wouldn't work as expected.
Basically, from what I can gather from the ZCB manual, you'll need to use 2708s if you want a 1K hole at 0xE800 without any board rework. I'd think that since VG left a 1K hole there when using 2708s, it was probably intended for stock N* monitor ROMs and a N* disk controller.