This is caused by the protocol, Reverse Path Forwarding (uRPF). This protocol checks incoming packets to see if (1) Do I have a matching entry for the source in the routing table? and (2) Do I use the same interface to reach this source where I received the packet?
When MON is enabled for an L2E segment in VMC, HCX will add /32 routes for all the VMs in the segment within the Tier-1 Gateway. In VMC-D, these /32 routes will be advertised to the Tier-0 Gateway over the downlink. The use case for MON is to allow VMs/Segments within the same Tier-1 Gateway to communicate with one another, without the need to route back OnPrem. As a compute VM/Segment will not be on the same Tier-1 Gateway as a management IP/VM, the MON policy routes are leveraged and will route the traffic to the OnPrem gateway.
Once the traffic comes back to VMC, the Tier-0 will receive it over the uplink and drop the packet due to uRPF. This is because the SDDC expects to see the traffic coming from the downlink, as the /32 routes are added to the Tier-0 route table, but the traffic is received by the Tier-0 over the uplink, in which uRPF drops it considering it an attack.