Not sure but does the patch mentioned here
https://community.ipfire.org/t/firewall-rules-for-ipsec-network-apparently-generated-multiple-times/15630/6
fix that issue?
It is in CU202.