Strange phenomenon seen in the tcpdump

I understand the lack of understanding and don't have a direct answer.

I would look further, try looking at another virtual server, how does the tcpdump output look there.

Double check the IP address, try with the source instead of the destination. This looks like FTP, perhaps an FTP profile is somehow involved?

And of course if you have a support contract reach out to F5 support, they can look at your full configuration and that makes things easier.