Probably false positives.
There have been some reports of flakiness with the TLS decoder rules in Suricata of late.
There is a post on the Suricata Redmine site about some other TLS issues.
#SURICATA TLS invalid record/traffic suppress gen_id 1, sig_id 2230010