The firewall performing a proxy ARP for a NAT address should not make the firewall start answering echo requests for that NAT address. They key is determining where the "mystery" ICMP reply is coming from, there are two possibilities:
1) Another system on the network - this doesn't sound likely since a tcpdump run on the firewall itself showed the echo reply. This would seem to indicate that the firewall sent/forwarded it in some capacity, but could also indicate that another system sent it and the local switch just flooded it to all switch ports. Please run your tcpdump again, this time with -ep to show MAC addresses and avoid the possible "observer effect" caused by promiscuous mode, respectively. Check the source MAC on the echo reply, if it belongs to the firewall's interface the firewall itself generated it or forwarded the reply from another interface. Also possible you have more than one IP subnet in use on the 10.110.10 VLAN which can cause some strange effects but that is unlikely.
2) Gaia/Linux or Check Point's code generated it - Whatcha McCallum had a good suggestion earlier to run a fw monitor which will help you determine what sent the echo reply. Run this command and post the output of a ping test with the NAT added:
fw monitor -e 'accept [9:1]=1;'
How many inspection points (iIoO) does the echo reply pass through? 2? 4? You could also start a continuous ping then watch the "ICMP messages sent" counter in the output of netstat -s, if it increments in time with the replies the Gaia IP driver is sending them.
One more thing:
Does cphaprob -a if show all interfaces as "up" or are you seeing "partially up" anywhere? Wondering if the Interface Active Check pnote thinks there is a problem with the network and is sending ping scans into the VLAN and your ping program is somehow interpreting this scan as a reply when it happens to hit the correct address. Also I assume that cphaprob stat shows a healthy cluster?
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
New 2-day Live "Max Power" Series Course Now Available:
"Gateway Performance Optimization R81.20" at maxpowerfirewalls.com