HTTP to HTTPS policy injecting "/Location: https:///" into URL and breaking application

Okay, one more idea. Try to capture the HTTP redirect response on the wire from the HTTP VIP.

tcpdump -lnni 0.0 -Xs0 port 80

You may need to add some additional filters to clean up the capture, but the -Xs0 option will show you the clear text HTTP payload in the HTTP response from the HTTP VIP. What you're specifically looking for is the HTTP/1.x 302 Found message and following Location header. What you find here will determine WHO is actually sending this funky URL.