Thanks for the reply, but according to the Forms documentation, the Primary Forms URL should be pointed to the NLB Forms sever where the Forms Routing Service is disabled. This is also the recommendation from support or have we misunderstood something?

More specifically: You need to point Workflow to an internal URL that routes to a Forms IIS web application instance that has a connection to the primary/internal Routing Service. The "Primary Forms Server URL" value in /FormsConfig is usually the correct one for this, but they're not directly tied. Workflow should not be pointed to the Forms web service on a DMZ Forms instance that's on a non-trusted/different/no domain server.

So tl;dr - point Workflow to https://internalformsinstance.example.com/Forms/. That should always work.

Deeper dive:

The documentation in the screenshot is not for the "multiple Forms servers, two in DMZ load balanced with the Forms routing service disabled, and one internal with the Forms routing service enabled" setup you described.

That screenshot is from Configuring a Forms Routing Service Cluster, a setup where there are multiple running Forms Routing Services that are load balanced. Forms Routing Service Clusters provide scale-out backend performance for especially high volume scenarios with hundreds to thousands of Form submissions per minute. The documentation for those assumes describes a scenario where there's a separate frontend server running the Forms IIS components (/Forms/ web service on https/443). The diagram is little confusing, but it's describing the NLB/load balancer being (logically) behind the Forms IIS instance, load balancing WCF traffic from the frontend Forms IIS app to the multiple backend Forms Routing Services. 

In any event, Routing Service Clusters are quite complicated and you don't have one here.

The Creating a Forms IIS Server Cluster docs describe/assume an all-internal load balanced Forms setup with two+ instances, all running the Forms IIS web app, and only one running the Routing Service. In this scenario, you set the Primary Forms Server URL to the load balancer address that goes to the Forms web apps, like https://forms.example.com/Forms/. You would point Workflow there, because it's an internal Forms web URL that goes to an internal Forms IIS instance connected to the internal Routing Service.