Well I'd say that there is definitely nothing wrong with just continuing to call CQ. After all, if you didn't have the SDR hearing the other station, you wouldn't know that the other guy is there calling you, so there must not be any had feelings for your lack of response.
My practical experience here is mostly related to SSB contests, but I think it could apply in your case as well. Normally, when I'm calling CQ and think that I hear another station answering, but I'm not sure, I'd reply with QRZ or partial callsign, if available.
Usually it would be something like
QRZ? de MYCALL or
Question mark Question Mark One Alpha Question mark, this is MYCALL, depending on how well I copied the sign. This way, you may indicate that you did hear something and ask the other station to fill in the blanks. One problem with the QRZ part is that some users may use QRZ instead of CQ and this way the hint may be misunderstood, so do try to send partial callsign if available.
If you do reply, and using SDR determine that the other station copied your reply, but is still too weak for you to copy, you may want to make it known to other station that the signal is too weak to be workable. I can't think of a widely-used Q-code to indicate very weak signal, but some things you could try would be sending QRK 1 and then QRS PSE. QRK is the code for signal readability, with 1 being the lowest grade and QRS is invitation to increase output power. Another alternative that comes to mind would be to send QSA 1 and QRO.
The procedure usually lasts until one of the sides of this potential QSO runs out of nerves or if the required contact data are successfully transferred.
If you do determine that reading the other station is too difficult, do try to make it known to other stations. Send something like sorry, too weak and continue calling CQ in hope that someone else may respond.