The problem is because the natt-ed IP is not getting changed within the RAS registration request message. Hence the gatekeeper will still see the original IP of the Callmanager and will try to send the registration confirm message back to the original IP and it fails.
You would need to use a PIX firewall with the fixup protocol h323 ras or a similar device that can do fix function.
These are the paths to get to each CCX logs through CLI. They may be helpful if you are having issues accessing RTMT or downloading logs through it.
If you want to download them you have to prefix "file get " and you can add one of the options (re...