Mangle rules layer 3 vs layer 4

There seems to be a common belief that action=mark-connection only marks connections which have not been marked yet. This is not true.

If a packet belonging to an already marked connection matches the conditions of another action=mark-connection rule, the connection mark gets rewritten by that rule.

So you either have to ensure that packets belonging to already marked connections are not handled by other action=mark-connection rules, or you have to add a match condition connection-mark=no-mark to each action=mark-connection rule.

Plus in most cases you want to assign the connection mark only to the initial packet of each connection, and this is also not automatic. So adding connection-state=new may be necessary as well.

Have a look here for one possible way of implementation.