Is there a way to mask JSESSIONID?

The first step to solve your issue is to determine what JSESSIONID is for your application - a Cookie, a Header, a Payload Parameter(POST) or a URI Parameter? JSESSIONID used to be a universal name for session cookies, but nowadays it's used in many different ways.

In any case, if that's a cookie which is inserted by BigIP, and is only significant for the balancing/persistency decisions in BigIP; it should not be a problem to use a substitution value. If that cookie has a significant function for the end-server or other middleware, there are more things to consider.

Your understanding about Data Guard is correct. It's only use is to mask the sensitive data values from the end-user, not from the back-end systems.