icap Antivirus with F5 Big IP

to set up an iCAP antivirus solution at F5 level in LTM:

is the f5 redirect all flows to the antivirus to scaning it or those that contain attachments?

for base64 and Json flows, how does the F5 process it to analyze their encapsulated content?