First question I have to ask is "what is the threshold for a SYN flood to trip?"

If it was a single IP then I wouldn't ask that, I'd look at the host.... but since your log shows two IP's I wonder if the threshold is set too low....

There's a gazillion web sites out there that call a gazillion of other pages that could "imitate" a SYN flood if the threshold is too low.

Not much help in your argument but it's my $2 worth...