Yes indeed hdr appears to be the wrong tool for the job. It is parsing comma as delimiter, so it returns 3 times in this case.
Replace it with fhdr, that should do the job.
http-request replace-value x-forwarded-for ^ "%[fhdr(x-forwarded-for)], %[src]"