Yes, that's my understanding too. That the ACL log messages and the VPN hardware errors point to fragmentation. That's the only explanation that makes sense to me and puts all the pieces of the discussion together. Reassembly timeouts are caught by ACL and fragmentation is a possibility with those VPN hardware errors. What one considers cosmetic depends. You might not see severe traffic disruption, but there might be actually lost packets in the tunnel when reassembly timeouts occur (maybe because the ACL denies them, maybe anyway). TCP traffic might start with some segments, loses few of them, retransmits and eventually adjusts to the network. This might explain why you see the messages every now and then, especially at higher traffic hours. Also, have in mind that in the first link I posted, it says that fragmentation in the tunnel is possible even if original host sets the DF bit. As the last link I posted suggests, you can either reduce the mss a little bit and/or set manually the DF bit for the tunnel.
Edit: I didn't say clearly that, if any issue exists here, it's not so much a few lost packets, since this is how TCP works anyway, but a potential of a small performance degradation for the routers every now and then depending on the frequency of the messages. And even if this isn't a real issue for your network, we knew that from the beginning based on what you said. Maybe the most serious issue here is to make those messages go away for good so we can all feel better, since nobody likes a router that complains all the time, even if it complains for nothing! Those log messages make the log harder to read and you might miss other issues in the future.
