The answer is probably going to be, it's a NAT issue.
Is the issue 100% reproducible or is it intermittent?
How is your controller connecting to SIP? On-site SIP gateway [this makes it less likely to be a NAT problem] or going to SIP provider on the internet with edge device doing some SIP rewriting? Or something more exotic?
Once you've double-checked the settings either on your edge device or on your SIP gateway, I would do a packet capture and look at what's happening when trying to retrieve a call from hold.
Maybe you could set "Avoid signalling hold to the Peer" to No