Doesn't look like there is any other 3rd party things. I've opened up a TAC now so will report back once I know the root cause.

To be clear, this is just VPN pass-through traffic over the ASA, there is no VPN router. infrastructure looks like this:Desktop user using software VPN client to customer > 6509-E switch > ASA > internet > customer VPN endpoint Cisco TAC for this cas...