Basically, what you're seeing is a result of how connection tracking works, how TCP works, and how those effect NAT processing.
When performing NAT, or otherwise having a firewall rule that requires connection tracking, the router keeps track of every connection that it sees. These connections will be one of four states: new, established, related, or invalid. You can use these states in firewall rules to perform very specific matching. NAT rules with a src-nat (or masquerade) action have an implicit match to new connection states only, that cannot be amended.
TCP connections consist of a specific sequence of packets -- the initial "new connection" packet will be a SYN, the first response from the remote server will be a SYN/ACK, and then your computer will send an ACK to complete the connection, and subsequent packets will flow. When the connection is done, one side will send an ACK/FIN, which is ACK'd by the remote side who then closes their connection the same way. If the router sees the ACK/FIN packet, it will clean up the connection and remove the NAT information from the connection tracking table. Once this happens, any more packets on the same connection will be "invalid" (unless a new connection is opened by starting with the SYN again).
So, the core of the problem is that a client inside the router is sending TCP packets on a connection that has already been closed with an ACK/FIN (or the router saw a RST come through -- which should reset that connection, and winds up causing the router to perform the same cleanup as if a FIN had been seen). After the ACK/FIN or RST, the client should be sending a SYN to start a new connection, which will cause the NAT rule to happen.
Otherwise, you need to discard the traffic in the router (preferably by sending a TCP reset to get the client to start over faster, instead of waiting for its internal timeout as you drop packets). The rule to do that would be:
/ip firewall filter add chain=forward protocol=tcp connection-state=invalid in-interface=<source interface of LAN/outbound traffic> action=reject reject-with=tcp-reset
