I am tesing these 2 rules:

add action=fasttrack-connection chain=forward comment=Fasttrack connection-state=established,related
add action=fasttrack-connection chain=forward comment=Fasttrack connection-state=established,related in-interface-list=WAN out-interface-list=LAN

I found that the below one still can catch packet, isn't the first one suppose catch all of them?

Are these two rules one after another (no other rule in between) and in this exact order? If answer is yes to both questions, then it is indeed weird for the second one to catch anything.

You could add "log=yes log-prefix=ftrack" to the second rule and check what kind of traffic triggers it.

Are these two rules one after another (no other rule in between) and in this exact order? If answer is yes to both questions, then it is indeed weird for the second one to catch anything.

You could add "log=yes log-prefix=ftrack" to the second rule and check what kind of traffic triggers it.

Yes it is next to each other in exact order, the log seems normal and I don't see different between that 2 rules log

For a fasttrack-ed connection, not all packets are handled by fast-track to allow connection tracking to keep it's data "up-to-date" and connection active. What you have described might be related to this.