F5 Health Monitor Receive String as JSON

400 errors could be related to the host header as mentioned but also incorrect TLS SNI or no TLS SNI (something you need to sync with your server engineers). Nowadays F5 HTTPS monitors support SNI, just see SSL settings used by an HTTPS monitor are now configured using a Server SSL profile and SNI support for HTTPS monitors as before F5 health monitors were based on openssl while tmm for production traffic has its own TLS settings for server side client traffic.