TCP RST logs

I know you mentioned not running wireshark for an uncertain duration but you could run a tcpdump capture on the BIG-IP to look for resets and reset causes related to port 636. https://support.f5.com/csp/article/K13223 https://support.f5.com/csp/article/K13637

Maybe something like... tcpdump -nni 0.0:nn -v 'tcp[tcpflags] & (tcp-rst) != 0' and port 636 -w /var/tmp/resets.pcap