Why does XMLHTTPRequests from IE 10/11 fail intermittently against F5 LTM+APM?

A reset in a TCP capture isn't going to tell you a lot anyway. Because we're talking about layer 7 communications, you need to know what's happening at the application layer. You need to be able to see the HTTP requests, what's in those requests (URIs, headers, cookies, payload), what's in the responses, and who exactly is generating the error. The fact that WEBSSO::disable solves the problem almost indicates that the backend server is sending the error, so you need to be looking at both sides of the proxy.

Unless I've misunderstood, you've indicated that multiple client types access this APM virtual server: browser clients (that authenticate via APM), XHR agents inside the browser clients, and clients that are not browser-based and that do not authenticate. Is this correct? And if so, how do the third set of clients pass through the access policy? And where do the errors occur, and to whom?