Syncookie threshold 1994 exceeded

You should read the following article that provides further information SOL14779: Overview of BIG-IP SYN cookie protection (11.3.x - 12.x)

You should note that the settings are per tmm so would trigger at a lower than expected rate when traffic is pinned to a single tmm such as from a limited range of IP addresses.

Configuration of the global threshold is at System>Configuration>Local Traffic>General ( SYN Check™ Activation Threshold ) and is set to 16384 by default. Try doubling it to 32768 first and see whether it still triggers. You can further narrow this down if you want to.