Hello,
You should be able to reproduce the problem. It will be easier to investigate.
You can capture traffic of a specific user using TCPDUMP.
Or you can also use my Irule:
https://devcentral.f5.com/s/articles/ultimate-irule-debug-capture-and-investigate-1183
It will allow you to see if you receive an abnormal behavior, unwanted response (503, 403, ...).
otherwise for a user who is frequently impacted, modify his host file to attack the server directly. and if he continues to encounter problems we can easily conclude that it does not come from F5.
it is a WEB application? or do you use a heavy client ?
regards