You try to connect from NB to server and it creates packet 10.7.8.148->10.7.8.141. It goes to router, it applies dstnat rule to forward it to server’s real address and it changes packet to 10.7.8.148->192.168.88.12. If you didn’t have srcnat rule, it would reach the server like this, it would try to reply and because it (probably) doesn’t have static route to 10.7.8.148, it would send it using its default gateway, which you write is not this router. Your srcnat rule further changes packet to 192.168.88.1->192.168.88.12. Server knows where to find 192.168.88.1 (in local subnet), so it sends reply packet to the right router. And router knows to which connection it belongs, so it changes everything back and NB gets reply packet from 10.7.8.141 as it expects.
All tcp traffic from ip address 192.168.88.12 which comes from ether2-master have to be masquarated? Can you approve my interpretation?
I also got working when excluded
It’s all tcp traffic to 192.168.88.12 which leaves router via ether2-master, and that’s to be masqueraded. In your case, if 192.168.88.0/24 is on ether2-master, out-interface is reduntant, because it won’t go anywhere else.