I am also looking into the possibility the reset was send because it did not match any of the uri's in the switch statement. I have checked the tcpdump and on a first glance I only see requests that should match, but I will have closer look.
Since the problem happened in the production environment the business decided to rollback to the CSS. We are now going to try to replicate the problem on our acceptance environment by increasing the test load. When this is ready I will add log statements in the default action to see if there are hits here.