I am mobile and will offer a quick answer with more detailed follow up on Tuesday or Thursday this week.
My hypothesis was the intercept had a lower precedence than the real IP because the real address'es network is directly attached.
To test this, I suggest a fictitious intercept (meaning from a subnet that is not attached to the client container).
I take it you tried inventing an intercept IP address in the same subnet that is attached to the client, but that would suffer from the same problem if the hypothesis is correct.
Assuming there are no networks in 10.0.0.0/8 attached to the client you can safely us an intercept address like 10.11.12.13.