You can't use different certificates for the same website (*). Use a public certificate, internal clients will trust it just fine.
(*) There are workarounds, but they are quite cumberstome and you shouldn't use them unless absolutely required.
After digging around a bit more and conferring again with the developers behind other, I think we've figured out this issue.
Basically, the site hosting server.com and all the applications under it that will be participating in the rewrite (common, as well as foo and bar until we are ready to delete them) need to be running in the same IIS app pool.
You need application performance monitoring (APM). Insight into where exactly requests are spending time in the application is necessary, which implies instrumentation of the app. As this can be a significant project, there is a decision to be made of build vs buy.
Build would be integrating various open source components. Check out OpenAPM landscape for a ...
It is the IP Restriction in the IP Address and Domain Restrictions settings for your site that is causing the issue. When using the WAF it is the WAF's IP address that is hitting your web server, and not your IP.
You may need to setup another form of access control ...