In addition to what @mspiers
said, can you confirm what they are clustering at System>Cluster>Cluster Properties? It is possible for each node to have independent information about user sessions that could negatively impact NTLM (or any other backend auth system).
In addition to all of that, can you confirm what is meant by "F5 DNS," please? DNS load balancing is not supported because there is no state and users may not be on the same node for each request; one side effect could be this (just as if a client launches, the side effect could be that users are asked to login again due to an invalid session).