Have you checked if the VPN certificate is still valid?
You can see that if you open the FW object in SmartConsole under ipsecVPN and then renew/view
Maybe worth renew it anyway on both members (after renew policy push).
Try to see the CRL traffic with tcpdump to be 100% sure it is sending yes or no. And if other side get's the traffic.
Sometimes firewall tries to do CRL via VPN tunnel towards management system that will create a looping issue 😉
tcpdump -nnei any port 18264
-------
If you like this post please give a thumbs up(kudo)! 🙂