Maybe try to do a tcpdump on the tapX interfaces, and look if you see same traffic everywhere, with wrong destination ip.
Do you see same traffic for netout too ? (because if it's a flood, you should only have same netin everywhere)
(Note: bridge-disable-mac-learning 1, need to restart of the vms to be applied)