Problems tunnel client-server IPSec through FortiClient IPSec RA VPN

We are using a Gate running 7.4.7 as a RA IPSec VPN for our clients, and the FortiClient is version 7.4.3.1790. One of the servers has a GPO that enforces encryption between the various clients and a server, and this traffic is never placed in the tunnel. The firewall logs shows traffic to all other servers, but there is absolutely nothing to the one server for which encryption is enforced. Best way to describe this is IPSec encapsulated in IPSec. We checked the routes on the client systems, which look good. For testing, I installed and configured FC, logged into the VPN, and it connected to the server just fine. We cannot disable the encryption settings in the GPO.

This is a deal breaker. Does anyone have an idea of what I can try to make this work? Thank you.