You're asking for a CMC with three exceptional parameters:
- High impedance. HBM ESD is 1.5 kΩ (approx.), and at quite high frequencies (significant energy in the 10-300 MHz range). Presumably, over 10 kΩ is desired, to have a significant impact on the current flow.
- Enough flux to absorb an entire ESD pulse without saturation. Roughly speaking, say that's 8 kV and 50 ns long, or 400 µVs. This isn't too bad, but doing it in a hurry will be difficult (ferrite, too, experiences skin effect!).
- And breakdown voltage to handle all that.
For reference, a small CMC might use a Ae = 10 mm2 core, in ferrite that saturates at 0.3 T, or 3 uVs/t. Thus it needs 133 turns (of twisted pair, to maintain signal integrity). Such a core might have AL = 2 µH/t2, or around 35 mH total inductance. Which is... available enough, not sure offhand about data-line type CMC, but power-line type CMCs sure.
But we can't use such a component due to the breakdown rating, and also the capacitance which dominates above a few MHz.
So we would need an even bigger core, to account for the longer magnetic path (le) needed to accommodate the longer/wider windings. Probably something 2cm across would do. It probably wouldn't need to be potted in this size, and maybe a smaller one (with potting) would do but I suspect the capacitance would still dominate -- your only cure for capacitance in a transformer is distance.
Personally, I've seen sparks go over CMCs before, during ESD testing of power supplies. Implies they can have enough impedance to at least drop a fair voltage -- mind, that was on an SMPS, so, working against a lower impedance ('Y' type capacitors to GND) so the CMC would indeed see more drop than otherwise. Also confirms a good reason to put spark gaps on the PCB, as are often seen under CMCs.
Anyway, we could also relax the constraints and say, how much CMC do we really need to improve survival of a given CAN interface chip? And, most of them offer at least middling ESD ratings (2-5kV?), if not more, so it would seem not much would be necessary. In that case, maybe only a few kΩ need be added; but it still has to handle the full brunt of the ESD pulse, so you're not getting away from the flux requirement, and the inductance or turns count doesn't improve much, either.
In conclusion, it's vastly easier to shunt such surges, than it is to try and ride them through.
Oh, and that's the one other thing you can do: full isolation. 3 kV isn't hard to achieve, there are even single IC solutions for it (e.g. TI ISO1050). A modest capacitor will shunt 10s of kV down to that, easily enough, while keeping galvanic isolation for other purposes if applicable.