So I run over 20 web applications behind ASM and I don't see what you are seeing here. So let me ask you a couple more questions.
What version are you running?
What does your resource provisioning look like?
What type of Virtual Server is this?
When you remove the HTTP Class do you keep or remove the http protocol profile on the Virtual Server?
Do you have a client SSL profile applied to the Virtual Server?
Are there any iRules attached to the Virtual Server?
From an ASM standpoint
Do you have IP Intelligence licensed and turned on in the policy?
Have you tried going in and disabling various protection you think may be the problem and retesting? I would do it one a at time
Mike