Good question, I have this question myself but I think this is the reason: the client does not accept the connection because of cert pinning, HSTS etc. and for this reason the client actively stops the connection.
Because the client closes the connection in a usual way no errors will be logged. I have tested this extensively with FileZilla > Help > Check for updates and have come to the above conclusion. Currently, I exclude these domain names from deep inspection.
But, If this problem is somehow traceable in the logs then I would like to hear about it!
FileZilla traffic capture
Rino Broer - NSE 1 to 5 certified