Aaron
Once again thanks for taking the time. You have assisted/provided me with 3 solutions that I can work off of to get this issue resolved.
9 times out of 10 I can find my answer searching the forum, but could not in this case.
Reading some older posts I believe it was you that posed the question to another member "Can you insert a different Header value?" Which I think we may move forward with.
At this point my tcpdump shows the first XFF to be the correct one.
I have run into similar symptoms before with 2 XFF addresses, and the last one always been the correct one.
Let me know were to send the beer man.