In my many years debugging Checkpoints I am yet to see "First packet isn't SYN" where the firewall is the culprit - so far it has always been the apps. Usually, it is either intermittent asymmetric routing or timeouts/keepalives the app doesn't send.
Once upon a time you could "solve" such problems by turning off Stateful Inspection for TCP packets in Global properties, but for the whole firewall, brr. And I actually saw people doing it, but it means you basically turn off firewall for the most part and I am not sure it is possible in newer versions anymore.
So as others have already said - look closer into the application traffic.