We have not had reports of false positives for this signature, at least none that I can recall. Is there a chance that there is some application that might be using the standard SSL port but sending unencrypted text in that connection?
It may help if you can enabled verbose alerts for that signature so we can begin to take a closer look.
Is it always the same attacker/victim pair, the same attacker or the same victim? Might there be anything unique about the host machines involved?
