Are you colocating your equipment or purchasing managed hosting? You mention colo, but if you're concerned about unencrypted data after doing SSL offload, then it sounds like you're doing managed hosting.
In the case of a colo where security is paramount (which it sounds like it is in your case) you would insist on physical security of your equipment - basically locks and keys. By doing this and ensuring your only connection to your provider/datacenter is your network provision, you can be sure that anything after that connection that you do within your environment is entirely secure.
In the alternate case, where you are purchasing hosting services such as dedicated servers, firewalls, l/b, networking etc, you can't really be 100% certain someone couldn't do a man-in-the-middle style attack by physically or virtually routing your non-SSL data thru some additional system.
If you ARE concerned about the security between your L/B and web servers, I don't see much point in stripping SSL and then re-adding a IPSEC VPN or similar. You would probably be better off allowing the SSL to pass thru completely to the web servers unhindered (except no doubt you want to use the reverse proxy functionality).