SEC7111 HTTP Security Compromised Generated by a JavaScript.

What version are you running?

I believe you could apply a "re-write policy" on the F5 so that anything it sees from http:// rewrites the responses to https://, or you could use an irule to re-write the specific response from the javascript. If the URL is embeded in the response body, you would could use a streams profile with iRule to re-write the javascript response that has the ref.

ex: (not tested)

when HTTP_RESPONSE {
  if { HTTP::header value Content-Type] contains "text"} {
    STREAM::expression \
    "@http:@https:@"
    STREAM::enable
  }
}