Bizzare 400 (bad request) errors

I'm baffled by by this situation so I'm hoping that trying to describe it will organize my notes and with luck people smarter than will have some idea what's happening.

The problem from the user perspective:

On one page hitting "submit" produces a fairly long GET request that results in the 400 error. Copying the address bar and pasting it into another tab works fine. For one user it is consistent. He's tried multiple browsers, computers, home and work networks.

The log files:

The access and request log files confirm with the user sees. first request results in a 400 error, the exact same request goes through okay with a 200 status.

The set up:

The web application is a Java EE app running in a tomcat container. Apache is used as a front-end to handle shibboleth authentication, then using reverse proxy to pass the request on to tomcat.

Note that shibboleth does not appear to be the problem as the page that causes the problem is not the first authentication has already been established.

Also note that tomcat never sees these requests, the error is generated by Apache.

To complicate things further:

The production system is running on a bare-metal machine with 32 hyper-threads. The OS is scientific Linux 6. There is a prototype system running under a VM using the same OS and the same Java app. The problem does not appear on the prototype system. The production system handles thousands of requests a day as far as I can tell only one person has this problem.

If you can think of anything else I can test it really appreciated.

Thanks,
Joe