F5 Client SSL

there is a chance you are not doing SSL offloading on the BIG-IP, you say you do, but if what you describe is true then that is an option for sure.

another might be the that the port 443 IP might be directly on the backup server and skip the BIG-IP somehow.

i would not focus on the F5 configuration but determine if you really see the SSL Labs request hit the BIG-IP and if it responds with the old or new certificate.