You're not using edge side includes (ESI), right? Otherwise, varnish shouldn't change the body at all, so I'd look very closely at the backend. Do you see two requests from varnish in the backend's access log? Does this also happen when you go through varnish but don't hit the cache (e.g. appending
?1234 to the URL)?