For a disease such as COVID-19, it is important to identify individuals in a population at heightened risk of infection, as well as broader patterns of infection spread. This is both to estimate burden on healthcare systems (given substantial variation in disease severity from person to person), and to better control the spread of infection. In Scotland, the circulation of SARS-CoV-2 continues to place sustained pressure on healthcare systems, even after a comprehensive vaccination programme and earlier strict non-pharmaceutical interventions. To better understand individuals at heightened risk, we analyse the spatio-temporal distribution of over 450,000 cases of COVID-19 registered in Scotland in the waves of the B.1.1.529 Omicron lineage from November 2021, and an earlier wave of the B.1.617.2 Delta lineage from May 2021. These cases are taken from a uniquely fine scale national data set specifying individual tests. We use random forest regression on local case numbers, informing the model with measures relating to local geography, demographics, deprivation, COVID-19 testing and vaccination coverage. We can then identify broader risk factors indicative of higher case numbers. Despite the Delta and Omicron waves occurring around six months apart, with different control measures and immunity from vaccination and prior infection, the overall risk factors remained broadly similar for both. We find that finer details and clusters in the case distribution are only adequately explained when incorporating a combination of all these factors, implying that variation in COVID-19 cases results from a complex interplay of individual-level behaviour, existing immunity, and willingness to test for COVID-19 at all. On comparing testing patterns to subsequent COVID-19 hospitalisations, we conjecture that the distribution of cases may not be representative of the wider pattern of infection, particularly with respect to local deprivation.