Also seeing this (also from the facebook CDN) - my firewall for IPv6 is pretty simple, and like you said it should be hitting the established rule. I tried playing with the "system conntrack" settings but that didn't seem to help (also my conntrack table only had ~200 entries at the time).
If you find a cause or solution, please share 