Sitecore Item URL with Custom Domain in Azure PaaS

This is probably similar to this question: Incorrect URLs when behind proxy

If you're terminating your request at the F5 and allowing the F5 to make the request directly to the *.azurewebsites.net URL, Sitecore is going to resolve the site with the *.azurewebsites.net URL and subsequently any links generated will be with that hostname. To remedy this, you'll need to use rewrite rules to rewrite the host header with the value of the header of the original request forwarded by the F5 which I believe is the X-FORWARDED-FOR header. There are a few quirks to rewriting the headers on an App Service and you can find more details about it from the below post. Even though this post covers Azure Application Gateway instead of an F5, the concept is the same and you'll need to perform similar steps to rewrite the host header.

https://georgechang.io/posts/2020/sitecore-multisite-support-with-azure-application-gateway-and-app-services/

You should set the custom domain as targetHostName if you want that in the urls.

The targetHostName is the host name to use when generating URLs to items within this site from the context of another site. If the targetHostName attribute is absent, Sitecore uses the value of the hostName attribute instead. Used only when the value of the Rendering.SiteResolving setting is true.

https://ericastockwellalpert.wordpress.com/2018/03/26/sitecore-link-resolving-multisites-hostname-pipes-and-target-hostname/

It could be that your firewall is not sending the original domain - you could change that or fix it with the targethostname property.