You have a deny on 'guest-deny-internal-acl', could that be it? I don't know what the alias 'Internal-Network' is though, you would have to check dst on your 'D' flag against the 'Internal-Network'
guest-deny-internal-acl
-----------------------
Priority Source Destination Service Application Action TimeRange Log Expired Queue TOS 8021P Blacklist Mirror DisScan ClassifyMedia IPv4/6 Contract
-------- ------ ----------- ------- ----------- ------ --------- --- ------- ----- --- ----- --------- ------ ------- ------------- ------ --------
1 user Internal-Network any deny Low 4