Thanks for all the replies!
In the end it was the Content-Length header causing the issue. I found the length by performing a capture and highlighting the body in Wireshark to get an approximation and then adjusting the length till I received the expected response for the monitor. I also noticed that when the Content-Length is excessive, the F5 loops around again on the request and appends x excess bytes to the end of the request - hence I think why there were two HTTP headers in the problematic request. This led me to work to reduce the Content-Length value.