Hi Mike,
In 9.4.4 and higher you shouldn't use the $:: prefix for referencing data groups in an iRule. In 10.x it would load but just return the class name. In 11.x you get a runtime error.
Out of curiosity, do you have client cert mode set to require with a frequency of every request? If so, you might be able to save some CPU by changing the cert frequency to once (per session) and parsing the cert subject on each HTTP request. Or do it once in CLIENTSSL_CLIENTCERT, save the result to the session table and then check the session table entry on each HTTP request. If you're open to changes let me know and I'll give more details.
Aaron