Mutual TLS is only going to protect the syslog data in flight, not at rest in the Splunk DB.

I contend that going after the netflow is the way- if the syslog were tampered with, the netflow would prove or refute those admin connections noted by syslog. Flows coming from the machines can be uniquely fingerprinted, router or not, to prove their origin.

If the netflow were tampered with, there would either be obvious gaps, or anomalies pointed out by what they already know from the machines.