Microsoft Exchange 2013 iApp - Can't login to OWA or ECP if more than one server is active in pool

IIRC, you can have multiple certs associated with a service now. Are the CA-issued certs still associated with IIS services in the Exchange Admin Center? If so, try deleting them completely from the list.

Does anyone connect to OWA using the internal OWA names? You may want to set the internal name to match the external name.

One thing you could try as a temporary workaround is to choose Exchange 2010 as your version in the iApp. This will apply cookie persistence to OWA requests, forcing them to go to the same pool member every time.