This is a HUGE topic, one that we cannot possibly cover completely here. But I'll give a quick overview of the basics. I'm not trying to be 100% correct here, but at least 98% correct. What I mean by that is that I'm going to gloss over some of the details but I'm still largely telling you the truth.
- If ESD messes up your system, and there is not a direct path from the spark to your circuit, then the energy is being transferred as a radio wave.
- Any antenna is as good at receiving radio waves as transmitting them. Meaning, the same things you do to keep a signal from radiating EMI is also the same things you do at preventing EMI from being received. Do this for any signal that is important, not just signals that are wiggling a lot.
- Pay very close attention to "loop area", and minimize it. Google it if you don't know the term. This goes for more than just PCB's. It applies to cables too.
- A lot of ESD issues are from connectors and cables. If you didn't address ESD issues then you can assume that you have ESD issues. You can't just build it and hope that ESD isn't an issue on connectors, you must make it a non-issue.
- Look for any signal that could wiggle due to ESD/EMI, and fix it. This includes unconnected pins, etc.
- Reset signals are a common problem place. Usually they are pulled high with a large pullup resistor, and it's easy for a spike to pull it down. Pay close attention to signal routing and use a lower-value resistor if possible.
- Read my answer on protecting against ESD here: ESD protection of ADC input
- Properly handling ESD/EMI on a 2 layer PCB is difficult, but not impossible. It's much easier to do this on a 4 layer PCB with power and ground planes/layers.
While your JTAG port could be causing issues, I suspect that if it is an issue then it's just one of many issues. I have JTAG ports on all of my boards and have never had problems with them. Of course I've designed my boards to handle ESD from the start.
3KV sparks is actually really small, and indicates that you have a serious problem. Although most regulatory stuff requires 8KV, I highly recommend testing to 15KV or even 20KV.
I can't give you more info unless I see schematics, a photo of the PCB, and possibly a pic of the PCB layout.