Thank you Henning.
I just tested with modparam("rr", "ignore_sips", 1) and indeed this solved the issue. NAT detection creates an alias that points to TLS which then causes the connection still using TLS even if the UAC used sips without transport attribute.