Greetings Leon.
Syslog transmissions are individual UDP packets, which are connectionless by definition. Is it possible that your F5 is doing node assignments using source affinity? (e.g. messages from machine 'A' always go to Node '1'?) I'm not expressly familiar with the F5 products, but I do have experience with load balancing, in general.
Since the syslog messages from any given source are individual UDP packets, by all rights those packets should be evenly spread out among the nodes behind a load balancer. If the F5 isn't working for you, it might be worth looking at the native Windows NLB capabilities, which I know will be able to round-robin those inbound UDP connections.