Request for interpretation of iRule entries in ltm log and further troubleshooting steps

What do the virtual servers look like? Just a 443 incoming and 0.0.0.0/0 forwarding for the outbound traffic? The 0 port typically means an all ports VIP, but that doesn't make sense for this scenario. It almost looks like the return traffic is missing the connection table on the inbound VIP, and hitting the forwarding VIP.

Can you post the second iRule and "tmsh list virtual" for those VIPs?

I'd recommend working with support on this, they should be able to hop on a call with you to track it down.