Unless the vendor is rolling something super custom, for the communication TO the keyboard, it should use USB HID.
Start Wireshark, filter for hid, connect the KB and the first message should be a HID descriptor of the KB, look for Output Reports (it's meant from the POV of the usb master) or Feature Reports.
Though, this will probably not yield much insight - vendors love to do the easy thing, reserve opaque 32x8 bytes as a "downlink" Output communication in the Vendor Usage Page and stuff their own protocol/encoding in there.
On linux I can recommend hid-tools for working with this, in windows I believe your only solution is Wireshark.
https://www.marcusfolkesson.se/blog/hid-report-descriptors/
Happy Hacking!
E: About the already reversed software, for logitech (and more) stuff, there is piper but you will want to look into the underlying daemon libratbag, there is also solaar