Hi,
my apologies for the delay.
The destination MAC address (01:00:5e:28:13:01) of all the traffic is the multicast MAC address of the default gateway (which is a firewall cluster):
Esample:
15:05:35.724101 00:50:56:91:74:91 (oui Unknown) > 01:00:5e:28:13:01 (oui Unknown), ethertype IPv4 (0x0800), length 1454: 192.168.1.7.www > 151.65.13.131.63688: Flags [.], seq 25259:26659, ack 2262, win 105, length 1400