Unfortunately given the geographic country involved here, it is likely that a "greater" firewall outside your control is messing with your traffic. The only real way to determine the cause is to obtain a simultaneous packet capture with tcpdump/cppcap on both sides while the issue is occurring; regrettably Check Point does not support the notion of "triggered" packet captures that automatically start when a certain condition is met.
That said, there are three features mentioned in my book that you can enable to provide some extra log visibility and perhaps help give you a better idea of what is going on:
1) sk101221: TCP state logging
2) Possibly disable Session Logging on the relevant rules matching the problematic traffic and set only "Connection Logging", which will produce more granular connection-based logs but there will be many more of them. For the difference see my CPX 2022 presentation Max Gander: The Hidden World of Log Generation & Suppression on Check Point.
3) Enable "Accounting" on the relevant rules matching the problematic traffic:
New 2-day Live "Max Power" Series Course Now Available:
"Gateway Performance Optimization R81.20" at maxpowerfirewalls.com