So I reviewed the configuration and we do indeed use routing domains. However, both VS reads client_addr with the routing domain suffix %2. I tried to strip the routing domain suffix according to your example just for the sake of it, but it did not make any difference.
The VS's does not explicitly reside in different traffic groups, however one of them is abit different then the other residing in traffic-group-2.
The first VS has the destination of 0.0.0.0%2, together with an iRule that checks for this table value. If the value is set, the user will be able to access Internet. If not, the user is redirected to an APM portal. The APM portal is where I set the table value.
I'am not sure if the VS("Performance (Layer 4)") that is doing ip-forwarding is in traffic-group-2 or not. It does not make use of a specific destination IP. Maybe it will be defaulted to the local group?
Might be the problem?