Besides that a HAproxy request, it reads as if it's a fail2ban problem, isn't it? If you receive the X-Forwarded-For header and hand that to fail2ban it should ban the correct IP otherwise one should have to rewrite the ban-action or do a custom one?
Another possibility would be to change your Owncloud Webserver to actually log the X-Forwarded-For IP instead of the client IP (haproxy itself). Then your fail2ban should actually read the correct IP from the log.
Third possibility is something we do for a few customers: we set up fail2ban on their servers for a couple of different web apps and run it on the apps logfiles. If some conditions are met (e.g. trying for SQL injections or requestion known PHP shell URLs), the IP gets "blacklisted" by Fail2Ban, but the ban action is actually a HTTP POST to a central server that reports the source server, project, URL, IP and reason that IP is "reported". That is written into a small database and a web server on top of it serves that data as simple URL blacklist with various options (show only banned IPs from certain projects etc.). So via this URL you can setup pfSense and pfBlockerNG to refresh one or more various blocklists to your liking and use them in filter rules. So we can filter out IPs for different project either depending on IPs getting blocked from their services only or by the "collective" of all customers reporting "shady things" ;)
Greets
