We've been testing this further.
- The problem doesn't occur when using TCP\UDP with-out making changes to our existing configuration. - If we change 'children' from 16 to 1 then the problem no longer occurs when using TLS.
Are there any significant drawbacks setting 'children' to 1? Thus far everything appears to be working as expected.