X-forwarded-for getting private client IP address

Http profile insert x-forwarded-for header from source client IP.

If the connection source IP is private, the bigip will insert the private ip.

If some customers request already include this header populated, the http profile won't remove it. The bigip is not able to know the private ip if it is not included in the request before.

I guess your problem is a firewall configuration issue and a not a bigip issue.