Radiator fan stuck on and on high in ignition and with engine running?

The fan is on high because of the Can bus comms issue, instead of taking the ECM apart scope the bus.

This first example is a known good (upper) and known bad (lower) from the Pico library,
the 2nd one is a vehicle I did some engine work on and noticed some codes setting during my prescan so I scope the bus to see what it looked like, ignore the purple waveform at the bottom, that's a math channel, the Blue is the Can High signal and the green is the Can Low, right off the bat, you can see a sloping waveform, but this is only the beginning section of one message. You can see the same effect in the 3rd waveform.

Waveforms 4, 5, 6 you can see I started to measure the voltage levels of each message packet, this is how you can tell the different modules talking on the network, some modules will have slightly different voltage levels depending on the wiring to that module or the distance from the data link connector, also any possible corrosion in connectors, But Can bus is a very robust 2 wire network and will still be able to transmit even with some wiring issues. Which is why this vehicle still running fine and still does, but it's obvious there's some wiring issues somewhere. In some cases, you will see much more obvious slopes in the waveform, or a waveform that is completely distorted.
You're getting some communication codes, so some module is not seeing another module on the network that it should be, I don't work on these vehicles because I just don't run into them at all in my area and I do a lot of mobile work, but I have seen these with the fan stuck on high with a no communication issue to the ECM.

The fact that you may not even have the correct ECM now is going to make things more difficult, but the vehicle runs, this code B1102 (and I don't know if that code number is correct or not) regardless, it's the Instrument Cluster complaining that it cannot communicate with the ECM. It does say if it's a Current or Historic code, but the Instrument Cluster is on the "Engine" Can Bus network along with the ECM (ME-SFI) which makes sense, since it's the Fan running on high that is the complaint right now, but the rest of the communication codes could all be related,
These vehicles have some many modules, diagram 8 is a list of the modules on just the Engine Can network, it might be that the Cluster and ECM cannot talk so the ECM has no way of knowing what the engine temperature might be, and therefore is defaulting the fan to high because of that reason.
What codes come back if you erase them all, (write all the codes down you have right now first) then see what comes back right away. It might take 1 or 2 drive cycles to trip a code,
but you can also go into the Cluster's live data and the ECM's live data with your scan tool and see if there's a difference in ECT data,

If your scan tool shows a network topology, it should show which modules are offline, some scan tools can do that some can't. I think yours show a topology or map of the networks, but these are just plain difficult vehicles to work on if you don't work on them all the time.
Another reason I stay away from them, and BWM, Jag, etc. Ya just end up in these situations that take forever, The Can wires between the Cluster and ECM are supposed to be
Green/White and Green. So, a twisted pair of those two wires will be your engine can bus.
This vehicle is older, so I suspect a wiring issue, water intrusion into connectors is what I find the most.

One last thing, your can bus resistance should not be 120 ohms, it should be 60 ohms between Can High and Can Low, so with the key Off, measuring between pins 6 and 14 should read 60 ohms. If you are reading 120 between 6 and 14, then one side of the network is open. You are reading 1 terminating resistor on the network. There should be (2) 120-ohm resistors in Parallel. It's also best to read the resistance of the network with the battery disconnected, stray voltage will change your ohms reading,
If you want me to post the engine bus diagrams I will, but see what codes come back first, and check some easy to access connectors for corrosion, especially ones exposed to the elements.
Sorry for the long post.

That is odd, do you see any green/white and green wires twisted in a pair coming out anywhere on the back of the DLC? Or possibly black/white and black twisted pair? I'm seeing different color options on different diagrams here. Component X11/4 is supposed to be the DLC showing pins 6 and 14 being Black/White and Black. Just remember the Can wires should always be a twisted pair, so something to keep an eye out for, but not knowing the complete history on this vehicle, who really knows what has been messed with in the past.
See what you have the back of the DLC and I'll post these diagrams for you.

Yeah, I'll pull everything on that network for you, when you say reference voltage, is this the red wire you're referring to? Or is it a different color wire?
The 4-wire fan harness plug looks like the "Electric Suction fan w/ AC integrated control option". I don't see any other 4 wire options for the fan, service info has the ECM wiring broken up into 2 sections, so I'm having to jump back and forth between the two.

The Cam sensor is a Hall effect sensor that has a 5volt Ref, if it was low, you would have more running issues, and more codes for sensors. It's unclear how many different 5v Ref there are internal to the ECM, but most Reference voltage issues are due to a shorted sensor that shares a ref voltage with other sensors, which will cause a no start condition if it's a critical sensor.
If the vehicle has been to the dealership and had an ECM thrown at it, this problem may have been happening for a long time, and you're just now getting stuck with it. And if a dealership Merc tech couldn't figure out what's going on with this, you know it is a tricky fault.

I'm just going over all the data you've posted so far, I need a refresher really quick.

Okay, so apparently there are a number of things that can cause the fan to stay on high all the time, many issues, many possibilities, but we know that the ECM is not requesting the fan on, we know that you're getting a code for no comms from the cluster to the ECM, below is a huge diagram of the entire CAN-C network, which is what the code is for, CAN-C.

Diagram 1 is all the modules, and their IDs listed, I've marked the Cluster and ECM for your vehicle.
I suspect a harness issue here, since one or more ECMs have been tried, but if you look at the entire CAN C wires (diagram 2), the Clusters bus wiring has to go through 2 Splices (Z37/13 and 14) Then the wires have to go all the way to the X18 connector, through another Splice (Z37/2 &3) then finally to the ECM.

Hope you like my artwork, anyway, we're not 100% sure other modules on one or the other section of that network are offline, but the wire colors are the same for the entire CAN-C. So, they shouldn't be too hard to find if you pick the ECM or cluster to start with, I'd say the ECM is the easier of the two. The Cluster and the AAC unit communicate on the CAN-B.

I think you're seeing codes for some AC sensors as well, you will probably find a corroded connector somewhere, but notice where the Humidity sensor is located (diagram 6) I think some of the ECMs in these are around that same area, in a plastic box that supposed to have a cover to prevent water from getting in. The back left of the engine compartment, when facing the vehicle is where the Humid sensor is, so you can unplug it and check it as well. Check the ECM harness side connector very well inside for any corrosion or spread pins and take me some pictures so I can see what's up.
The Right Front SAM module supplies power for the fan, or is supposed to anyway, but the command should come from the ECM, so that means the fan is defaulting to high due to a lack of control, I would concentrate more on checking for wiring issues than just scoping the signal to the fan, many vehicles can use known good learned data when there's a networking or module down issue. Keep an eye out for those green/white and green twisted wires, that's your CAN C.
I've read a million reports of different faults causing this same issue, Fan on high with ign On. Find something so we can be special and fix this car.

With the humidity sensor though, since that and the sun sensor receive a 12volt feed from the AAC module and also share a ground and a connector in series to the AAC, I would check to make sure that 12volts and ground are good. It might be a 12volt reference, but either way with those setting codes, I'd take the time to at least see what's going on with them.
And yes, I'm sure disconnecting the battery erased codes that may have been stored, I don't know if that vehicle has a 2nd battery being that year. So, more codes might set if you take it for at least 2 drive cycles, some codes will take more than one key on drive cycle to set.
Where is the ECM located on the vehicle? Is it in the engine compartment on the back passenger side? In a big plastic box?

I dont know what kind of resistors are in the fan module, pull down or up circuits are usually for position sensors, plus theres the bulletin on a different harness for the fan, but you said the ECM has been replaced, if the fan is running unplugged the harness then its running on its default fast speed because theres no control from the ECM.

The fan operations states, "The AAC control and operating Unit transmits the status of the air conditioning via the CAN data bus to the ME control unit. The Fan specified speed is dependent on this and on the coolant temperature".
But obviously there is no control to it or the ECM (ME) would be reading a percentage but its not.
Im not a Merc Benz engineer though, I cant tell you how they build their modules. Especially from 2003. I wouldnt read into the waveform too much, you dont know whats a known good signal looks like, Id think it would be pulling fully to ground as well, but with Data bus codes, you could replace the fan, ECM, and who knows what else and still have the same problem if its a wiring issue. There could be a connector somewhere thats full of corrosion, I assume there is a main power wire going to the fan if its running with the harness disconnected? Wheres the power coming from?

Yeah, there would have to be a power mosfet on the feed or ground to control the fan, that's why I had asked awhile back if that signal wire was shorted to a 5v ref, but then you stated it was actually only 3.8v, on any power circuit that I've ever designed that used a mosfet I've always had a 10k resistor between the Source and Gate of the FET, these are usually almost always only 5 or 12v circuits, but it depends on the size of the resistor too, this 10K helps to pull the FET fully to ground, but it is only a 1/4watt resistor as well, something like a fan is going to pull amps.
You could do a resistance check from the signal wire to the ECM and see if its either shorted to ground or an open circuit, so measuring starting on the fan wire since you already know which one that is, measure from the wire to ground for continuity, if its ok, no reading (OL) then measure from the fan to the ECM and see if that reads OL, it shouldn't, it should be less than 5ohms if the wire is complete. And actually, you should get the same waveform at the ECM wire that you're seeing at the fan. If it's not an open wire you would see the same waveform at the ECM. If so, you could cut the wire or de-pin it and see what happens to the fan, my guess is that the fan might stay high. Being that it's supposed to be a 12v signal as you looked up, that lack of voltage on the signal wire is the reason its most likely defaulted to high speed. Calling a bad ECM or any module for that matter is always a difficult call. But I would see what kind of signal is coming out of the ECM. If there's a 12v signal you know the wire is probably corroded (resistance) between the fan and ECM, and hence the low voltage.
The only connection on the wiring diagrams between the fan and ECM is the Right Front fuse and relay module, which I believe is the Right front SAM module.

I stand corrected, the Right Front SAM module is labelled as N10/7 and the Right Front fuse and relay module is labelled K40/7, so it's not a SAM control module, but the wiring for the fan does go through that Right Front fuse module, after the fan, for some reason they run the control wire of the fan into and out of the Fuse/relay module, I'm never sure why they do that if it really has no effect on the circuit. I think engineers like to make things more confusing than necessary.

This wire I highlighted in green is the control wire coming from M4/7 (fan). I don't know if that's correct with this specific vehicle, because there are changes in design about halfway through 2002 when this vehicle would be in production.
If that fan cover comes off with a few bolts or screws, you could take the cover off and look for a broken or burnt solder joint. I find plenty of broken solder joints that's for sure.