client ip address unstable fails "source ip affinity"

This likely isn't due to a problem with your BIG-IP. Sounds like your client could have multiple egress points in their local network. Some device in their network could also be inserting the X-forwarded-for header.

Taking the X-forwarded-for header out of the mix, does the BIG-IP always see traffic sourced from the same origin IP address of the client or does it change? If you were to do a tcpdump monitoring on the virtual server IP address, you should be able to see the behavior.