Since it is firewall dropping the packet, and during initial connection (that’s why websites load slow), I doubt it’s ECN. Firewall would know about ECN.