Random HTTP 400 Errors

Can you reproduce the issue? If so, I'd try capturing a tcpdump on LTM and use Fiddler2 to log the clientside HTTP. You can also add a debug event to the end of the iRule to log when a replacement is done:

 From: http://devcentral.f5.com/wiki/default.aspx/iRules/stream__expression
 Example which replaces http:// with https:// in response content
 Prevents server compression in responses
when HTTP_REQUEST {

    Disable the stream filter for all requests
   STREAM::disable

   set log_line "[IP::client_addr]:[TCP::client_port]: [HTTP::method] request to [HTTP::host][HTTP::uri]"
   log local0. $log_line
}
when HTTP_RESPONSE {

    Check if response type is text
   if {[HTTP::header value Content-Type] contains "text"}{

       Replace http:// with https://
      STREAM::expression {@http://@https://@}

       Enable the stream filter for this response only
      STREAM::enable
   }
}
when STREAM_MATCHED {
   log local0. "$log_line, matched [STREAM::match]"
}

Aaron