Hello all,
We solved this issue with the help of Richard Fuchs. There were two issues:
1. The iptables module was in the wrong location and thus wasn't loaded. The daemon thought that the kernel was handling packets
and took the ROC updates from it, but didn't actually see any
packets and so the ROC reset, resulting in decryption errors. The correct location can be found with "pkg-config xtables --variable=xtlibdir".
2. Even after fixing the above, the iptables module didn't load properly until rtpengine was stopped, the iptables rules removed, the kernel module unloaded, and then this process reversed to load everything again.
I hope this helps someone else in the future.