On the Site to Site configuration page of the vMX there should be an option to switch NAT traversal between automatic and manual. The port will be configure on the vMX but you'll need to make sure the IP matches whatever elastic IP or some such publi...

Have you tried configuring a manual VPN IP/port for your vMX? If there's issues like the other poster suggested it may be resolved by this. Specifically, if the src port of outbound UDP connections at your broken sites are being remapped, the NAT pu...