Hey DW,
Thinking about this additionally, I'm not sure that only having the capacitor in the setup will solve the problem either. Charge injection is caused by not having a path to ground for the multiplexer to discharge. Placing a capacitor in parallel with an input doesn't provide an effective path to ground when scanning at a fast rate (I don't think the cap is allowing the multiplexer to discharge).
If you take the 10 pf capacitor away and look at the signal without the cap, do you see charge injection?
I'm just curious to see whether the cap itself is causing the problem.
Regards,
Todd