Looks to be a NAT firewall issue. It seems that asterisk has a good audio path to both SIP devices. That being said, the easiest solution is to keep asterisk in the media path. Right now your UAs are issuing re-invite requests to take asterisk out and pass RTP directly between them. While this is very efficient it is also very tricky to configure properly with NAT environments.
I would add
reinvite=no
canreinvite=no
to your SIP config for the SIP extensions in question.
There are some tricks you can do to try and get direct audio path from UA to UA without passing through asterisk. In my opinion it’s probably a waste of time and will cause more headaches than it’s worth.
Assuming you aren’t trying to support tons of concurrent calls on your server you should be fine allowing asterisk to stay in the media path. You actually gain a lot of functionality for very little downside. It certainly makes things easier from a management point of view.