Hang on. I managed to figure that out. The --id is for the key object id. If we make the AES key using your example above, then we can use the following version also.
pkcs11-tool --module /usr/local/lib/libsc-hsm-pkcs11.so -O --login --pin 648219 --label AES --encrypt --mech AES-CBC --input-file plain --output-file cipher
I also had to compile pkcs11-tool from the source here GitHub - OpenSC/OpenSC: Open source smart card tools and middleware. PKCS#11/MiniDriver/Tokend to make the pkcs11-tool: unrecognized option '--encrypt' error go away.