Configuring APM for Kerberos authentication but my Big-IP is on a stick

As you mentioned, the virtual servers will have to have snat, so the traffic from servers returns to F5.

For APM, all depends of your network configuration. As the traffic is generated from the F5, snat does not apply here. Anyway, you should have a self IP in the network you want to use as source, and make sure the correct routes exist to force the use of that self IP.