Probably false positives.

There have been some reports of flakiness with the TLS decoder rules in Suricata of late.

There is a post on the Suricata Redmine site about some other TLS issues.

#SURICATA TLS invalid record/traffic
suppress gen_id 1, sig_id 2230010