IP fragments being blocked by the firewall in a zone policy or anti-DDoS profile?
Did you make a trace on both sides (clock and HQ clock software)? If so, which packets did you see and which packets didn't you see?