Just a quick thought: perhaps it could work like this if your replication slave is doing its work with a delay time, so it gets the changes a bit later (i.e. the update flag ist still there)
Another thing may be to rsync passwd and shadow files. As you said, the machines were originally cloned from the same VM so it should always stay in sync and besides the database replication and the whole directory tree under /var/www that is the only thing together with the VHost file of apache2 to keep in sync.
So perhaps it would be a possibility to do a full replica of the DB, sync /var/www, /etc/apache2/vhost/ & /etc/passwd, /etc/shadow, /etc/groups
Just a quick one, but I think the better way for staying in sync is to use ISPConfig3s multiple server configuration. v2 wasn't exactly made for that.