what F5 product is needed to remove a header from traffic outside our domain?

If your site is using an iframe to load the external link, I don't think there's much you can do, because external sites wouldn't be routed through your F5 appliance. The client's browser would be sending a request directly to the external site, so any headers or response from them would go directly to the client.

The only real way to resolve this would be if you were using something like a web proxy (like what the APM does) that can rewrite urls, and causes all traffic to be proxied through the F5.