There is a pURL field in CycloneDx that is not being utilized. This field should meet the pURL spec (https://github.com/package-url/purl-spec) (see https://github.com/package-url/packageurl-go as an option).