Unfortunately given the geographic country involved here, it is likely that a "greater" firewall outside your control is messing with your traffic. The only real way to determine the cause is to obtain a simultaneous packet capture with tcpdump/cppcap on both sides while the issue is occurring; regrettably Check Point does not support the notion of "triggered" packet captures that automatically start when a certain condition is met.
That said, there are three features mentioned in my book that you can enable to provide some extra log visibility and perhaps help give you a better idea of what is going on:
1) sk101221: TCP state logging
2) Possibly disable Session Logging on the relevant rules matching the problematic traffic and set only "Connection Logging", which will produce more granular connection-based logs but there will be many more of them. For the difference see my CPX 2022 presentation Max Gander: The Hidden World of Log Generation & Suppression on Check Point.
3) Enable "Accounting" on the relevant rules matching the problematic traffic:
Updated 2023 IPS/AV/ABOT R81.20 Course now
available at maxpowerfirewalls.com