Squid (the web proxy) was updated in CU171 from 5.6 to 5.7 and from 5.5 to 5.6 with CU169.
Might be worth trying without the web proxy enabled to test if squid is involved in the problem. Understand that with people using the system that test may not be easy to do.
Post from another user had problems with pinholes from blue to green not working with CU171 but worked with CU169 but worked with CU171 if transparent proxy turned off.
https://community.ipfire.org/t/fw-pinholes-not-working-with-squid-transparent-proxy-on-blue-core-171/8840
The changes from squid 5.6 to 5.7 were just bug fixes so nothing that would be expected to cause the problem. As turning off the transparent proxy made his firewall rule work it would be worth a try if you could find a way to schedule the test on your system.
On my live system I am not using transparent with the web proxy.
I am hoping to be able to test out transparent proxy with pinholes on my vm testbed next week when my system is available again.