Nothing in our load balancer (vmware AVI) but this ended up being the cause of our similar problem. Once we disabled the option in our FW, we've not had any more disconnects -
(TLS Server Identity Discovery/Early application detection and URL categorization )
https://community.cisco.com/t5/network-security/connection-timeout-issues-after-migrating-from-asa-t...
