F5 LTM initiates SSL connection on the server-side

We have a virtual server which needs to route traffic to 3 pools based on the incomming uri. one pool has the servers listening on an ssl port and other 2 are non-ssl. The VIP has both client and server-side ssl provide applied. We have irule on the VIP to disable the server-side ssl for the 2 pools with non-ssl port. For some reason the F5 is trying to initiate an https server side connection and server listening on the non-ssl port responds with 400 (which is expected). Its not all the time though, its pretty sporadic and we have seen this in the pcaps.

elseif {[HTTP::uri] starts_with "/abc/"}{
set uri [HTTP::uri] 
#HTTP::uri [string map {"/abc/" "/def/"} $uri]
#log local0. "[HTTP::uri]"
SSL::disable serverside
snat none
pool xyz_pool
}

Thanks!