Need some help troubleshooting an issue - how best to do it

SteveEason Unless the F5 is configured to respond with the 400 status code this would not show up in the LTM logs. If you all have looked at the server and never see the 400 response then you might check on the client side and see what is the value in the HTTP header "Server:" to see if you can have a better understanding of what device is responding with that 400. In addition to this I would setup a rotating tcpdump on the F5 that saves to a file and then overwrites that file once it reaches a certain file size. Doing this rotation should allow you enough time, assuming this isn't a high traffic virtual server, to log into the F5 and export the capture and then parse through it for the specific HTTP response status code of 400. Troubleshooting intermitent issues is always troublesome because it makes it difficult to see exactly what was happening at the specific time of the clients query.