I figured out that the problem was the log pattern. The "common" pattern doesn't pick up the actual client IP address in this behind-a-loadbalancer situation.
The following pattern replicates the "common" pattern, but properly inserts the client IP address using pattern element %a:
pattern='%a %l %u %t "%r" %s %b'
Mind the use of single and double quotes, as the %r parameter (first line of http request) is quoted in the common log pattern.
Also, the "proxy-address-forwarding="true"" parameter in the http-listener element is not necessary.