NLB preserving client IP addresses in combination with NACL having source CIDR constraint

I have a VPC with two subnets, each subnet containing an EC2 instance accessible via port 80. There is a NACL associated with both subnets restricting inbound traffic to a certain source CIDR outside of AWS. An internet-facing NLB is configured to route traffic to the instances via instance id.

If "preserve client ip addresses" is disabled, everything works fine, requests originating from the correct CIDR are reaching port 80. But if it is enabled, my requests are timing out.

A solution is to add a rule to the NACL allowing inbound traffic from the VPC itself. This is in line with what the documentation says. But I don't understand why this is required only when preserving client ip addresses. It is preserving the source ip address, it should be covered by the original NACL.

I guess the answer is something like "... because Hyperplane", but I would like to have a deeper understanding.