How could I use iRule and Data Group vs Query Logging on External GTM's

I'd say put all the 300 domains in question into a data group, then for each request where the domain matches an entry in the data group make a log request against your Splunk. Just make sure you do not write anything into the default logs on the BigIP box itself. You can use high speed logging for your purpose.