In general, Community Builder's CBSubs was a major pain to configure. However, one key piece that I didn't find documented was this.
In the PayPal Account and PDT Identity token area, use your Merchant ID in the PayPal Business (email or secure merchant ID) field and your primary account e-mail address in the PayPal Main receiver account (email) (if Business is different from your main account) field. This should get everything to work properly with a live account.
Using a paypal sandbox can still result in generating the error message:
Please tell sysadmin to enable IPN and PDT in his Paypal account.
Even when both of these are actually enabled.