Without extract of your configuraiton, it's hard to spot the exact reason.
Anyhow, the BigIP is a default deny device, so if there is syn ack, it mean you match something and you are not in the default behavior : maybe there is a virtual server listening on any ip (0.0.0.0/0) or a subnet that match the trafic, as described in this article : https://support.f5.com/csp/article/K14800
