As Vikas mentioned, you seem to be correct that a d-nat is occuring on the flow. I see you already looked at the MIP for the tunnel interface and assume it does not include this one but only the one listed.
Under policies look in the advanced tab for the matching policy that permits this flow to see if it is set there.
Also check for a VIP on the tunnel inteface.