What do you see under " show running-config sys snmp trap-source"
F5 can use different outgoing interfaces to send snmp traps. You can even modify and configure source interface as per your requirement for snmp traps. Please refer below article.
Hope it helps!
The source is set to "default" in trap configuration - can't really find a definition of "default".
Tcpdump was one of my first ideas, however hard to track the source when traps are not firing that often.
Do you have any specific host route for SNMP server or is it using default route to reach it from F5? I think, unless SNMP server is a connected network, it would use the interface to go to server where the default route is pointed.