To resolve this issue, use any one of the options:

Reconfigure the vSAN Witness host/appliance network MTU to 9000.

Note: This may not be feasible due to WAN limitations. Consult your Network team and seek advice.

Change vSAN Data nodes network MTU to 1500.

Separate witness and vSAN traffic by creating new VMKs with 1500 MTU, or use a VMK that has connectivity to the witness and is already set for 1500 MTU and tag them for witness traffic. This will resolve the issue by using that vmk for the health check to the witness instead of the vSAN vmks which are set to 9000 MTU.

Tagging for Witness: esxcli vsan network ip add -i vmkx -T=witness   (x= which vmk you want to tag)

vSAN MTU health check will send large package size like 9000 to target host, and the actual package size will exceed 9000 with additional headers.  Hence the package will be fragmented. But in some scenarios, package fragmentation is not support by WAN providers. This is a known issue, and we reduce the package size as 8952 since vSphere 7.0 p01 release. If such health check warning is observed, Run the vmkping command as below on ESXi host.

vmkping -I <target_vmk> <target_IP> -s 8952 -d

As long as vmkping succeeds, there will not be any performance issues and I/O errors. Warning can be safely ignored.