Is this affecting anyone being able to use the site itself?
i agree, it looks to be IDS related.
After a fair few pcaps - I'm running out of unused IP's in my collection here!
Process is very repeatable, first connect, TCP RST then it works.
In a browser, this seems to resolve itself so may be working as intended.
For me, a browser is still sub 1 second load time. even with this little RST. which is what i'd call, acceptable