BIG-IP LTM v15.1.4
When accessing our website through the F5 (VIP), the cache-control response headers are not honoring the values returned by the member servers in the Pool. When accessing the webservers directly (not through the F5) the cache-control header values are correct.
INCORRECT HEADERS = cache-control: private
CORRECT HEADERS = cache-control: no-cache, no-store
We do not have any iRules modifying this header, we are not using Web Application Proxy (WAP), Web Acceleration, etc.
there is a known issue, but that seems to describe the opposite of your issue: CACHE::enable failed on private/no-store content.
If you are suspecting the BIG-IP is altering the Cache-Control headers, you should take a tcpdump and compare client and server side. You can use the p interface modifier to capture client and server side traffic in one capture (K20233108: Running the tcpdump utility using the p interface modifier).
As @Daniel_Wolf mentioned it seems that this could be an issue. Also check for irules that can be doing this or if the Web acceleration profile has a setting "Ignore Headers" to none (it should be for th request headers but it could another bug)
You can test an irule as a workaround and also check the F5 bug tracker just in case: