GTM https health monitor has never worked

GTM delegates monitoring where possible. If the server is a BIGIP it will defer to the monitoring provided by the LTM. When server is not it will delegate its monitoring to a BIGIP in the same data center. When GTM is initially setup, big3d software is installed to all BIGIP's. GTM sends out requests to that software which then monitors non BIGIP servers on its behalf. If this is not available then finally GTM will do the monitoring itself.

So testing from your GTM may not actually reflect where the monitor is actually coming from. It is likely delegated to a LTM in the data center which does not have access to the server. You need to run your curl from those devices and make sure they can reach the server.