iRule to only allow private networks....

Maybe this clients are behind NAT? you can check it by adding log to the iRule:

when HTTP_REQUEST {
  switch -glob [string tolower [HTTP::uri]] {
    "*/wp-admin/*" -
    "*/wp-login.php" -
    "*/phpmyadmin/*" -
    "*/wp-config.php" {
      if { !([class match [IP::client_addr] equals private_net])} {
      log local0. "rejected client ip [IP::client_addr]" <-- new added line
         reject
      }
    }
  }
}

and check which IP do you see in /var/log/ltm

good luck!