Postmortem:
The Microsoft Azure Networking team has finished their investigation with the following remark:
"
Appgw V2 ALL listeners utilizing keyvault are suddenly disabled during a keyvault POLL event due to MI renewal causing outage. Suddenly all traffic handled by https listeners that are associated to keyvault certs (which are fine) are set to disabled and traffic is lost.

For mitigation, try the put on the appgw again. Any new change on the appgw should resolve it. And you have done for it, this has since been mitigated, so as to not occur again.
...
This event was a small-scale sporadic event.
"
Based on this we find no further investigation in Omnidocs neccessary.

The issue was resolved. We are investigating this issue with Microsoft to get an understanding about what triggered the inconsistencies in the Application Gateway SSL handshake.

Application gateway was restarted.

Connected Services and Custom Functions went down.