The dump-flows output show that there are pods with duplicate IP addresses. And so the health check fails for this pod because the packets are getting sent to the *other* pod that has that IP address.
Probably this was caused by some sort of bug in the 3.2->3.3 upgrade; the journal output attached above doesn't go back far enough to show how we originally got into this situation.
I think the simplest fix is to make the node unschedulable, delete all of the pods on it, reboot the node, and then make it schedulable again. Assuming the problem actually was upgrade-related, it shouldn't recur.