I didn’t find a solution other than use a separate firewall. Not a good solution, but can’t have a client down. I have another client with the same server setup and everything works for Leopard clients, but the long delay for Tiger clients.
Initially for the firewall I used the default to allow everything on internal and only DNS and VPN on external NIC. When that failed I tried removing ALL rules and flushed it to make sure it was clear. Same problem. Just turning the firewall on causes the problem.