Before 7.5, FastTrack NAT connections could be reported as hw-offloaded despite still getting processed by the CPU. In 7.5 those are actually hw-offloaded. Maybe the problem is that the hardware cannot handle some types of connections (e.g. a tunneled connection), so those shouldn’t be offloaded in the first place. Please create a support ticket, so we can investigate the problem.