This is quite a common problem on front panels as far as I am concerned. I always sort mine out so they can handle ±15kV discharges without a problem. At 15kV it is very pyro-technic and FUN!
The stuff I work on has a metal case. The ESD wants to be on the outside of the metal case. By that I mean that wherever you inject the stuff it will take the shortest path to get to the outside of the case.
Shafts of pots, rotary encoders, switches and the like often have ground connections. So you tie them to the ground of your system and the system gets wrecked by the ESD. CMOS chips get blown or change state. Any registered (latched) data gets corrupted. Yep, been there and done it.
By all means use a 4 layer pcb. However, the outer layer, the layer closest to the outside of the instrument must be the ESD "escape plane" to which the switches and shafts are connected. Nothing else must be connected to this plane. Route the ESD plane to the outside of the case by pillars or other links.
The wavefront of ESD has a sub-pico-second risetime. The instantaneous voltage difference between parts of the plane is never less than hundreds of volts and rings like crazy. Any logic device connected to the ESD plane would either get trashed or change state.
You have to be able to visualise where the current is going to flow when it is injected. If you were an electron, which way would you go in your pursuit of the freedom of the outside world? Remember Faraday’s ice pail? Charge resides on the outside of a conductor. Well ESD does too, but it has to get there first!
Once you get the hang of this it is not difficult. Plan the design from the beginning so that any injection point has an easy path to the outside of the case.