See this question and this question.
It turns out that to load a COM class into a surrogate process, you must not specify any of the CLSCTX_INPROC flags when calling CoCreateInstance.
So: how do I allow my host to use CLSCTX_ALL, but allow the individual COM classes to opt in to using DLLHOST?
The reason I ask is that I locate my COM classes by using component categories, and I pass CLSCTX_ALL when creating them. I'd like most of them to be in-proc, but for some of them to be able to be out-of-proc.