That sounds like the dreaded "Long TTL hit-for-pass object" issue. The situation happens when an object which should be cached gets hit with a request which ca

That sounds like the dreaded "Long TTL hit-for-pass object" issue. The situation happens when an object which should be cached gets hit with a request which causes 'pass' (typically because of headers tested in builtin.vcl) and then VCL (by accident) setting the long TTL for caching on the "hit-for-pass" object. It's an ugly corner case which we have struggled a lot with finding a solution for, which doesn't have worse side-effects than the problem we are trying to fix. I think it is mostly a solved problem from Varnish 5.