Persistence on value present in one of 3 places

Don't know if this works for you, but the iRule below uses a regular expression to match the ref. If the format of the ref is unique in the traffic that is passing this iRule, then it should be okay. Otherwise you might need to tweak the regular expression a bit.

when HTTP_REQUEST {
    if {[string tolower [URI::query [HTTP::uri] "ref"]] != ""}{
        set req_trvalue [string tolower [URI::query [HTTP::uri] "ref"]]
        log local0. "REF URI: $req_trvalue"
        persist uie $req_trvalue 43200
	} else {
	    # match strings like 7c974593-b5e1-4885-a1e1-0a33403bb094
	    set lref [regexp -inline {[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-\S{4}-[a-z0-9]{12}} [HTTP::request]]
		if { !($lref == "") } {
		    set req_trvalue [join $lref]
			log local0. "REF HEADER: $req_trvalue"
			persist uie $req_trvalue 43200
		} else {
		    HTTP::collect [HTTP::header Content-Length]
		}
	}
}

when HTTP_REQUEST_DATA {
    # match strings like 7c974593-b5e1-4885-a1e1-0a33403bb094
    set lref [regexp -inline {[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-\S{4}-[a-z0-9]{12}} [HTTP::payload]]
    if { !($lref == "") } {
	    set req_trvalue [join $lref]
		log local0. "XREF BODY: $req_trvalue"
		persist uie $req_trvalue 43200
    }
    HTTP::release
}

Have fun,

     --Niels