Port strict and NAT are unrelated. What is related is that at least Microsoft VPN client needs to be tweaked in registry to accept an L2TP server listening on a private address behind a NAT. But it can also be done without tweaking the registry using the method described here.
But as you stubbornly refuse to post obfuscated but otherwise complete configuration export, I’m only guessing that the Mikrotik itself is behind a NAT. If it is not, restricting the src-address of the policy template to a single private address is a nonsense. So either you’ve obfuscated an IP which is actually a public one using a private one, or I don’t understand how the config could have worked before the upgrade because the NAT detection mechanism is the same all the time and the intolerance of the Windows client to server-side NAT lasts for years. My only explanation for that is that the Windows settings permit fallback to IPsec-less L2TP and it worked that way all the time.
So:
- post the complete config and obfuscate public addresses, if any, using symbolic names rather than randomly generated digit strings
- if the Mikrotik doesn’t have a public IP on itself, provide a network diagram from the interface on the external device which holds the public IP down to the Mikrotik