After some more more testing I think I've discovered an interesting thing.

When the WiFi module changes a setting (i.e. a setting is changed from the app) something actually writes 90 words starting at 1091 to address 99. Maybe this strange setup actually houses multiple clients?

Something continuously tries to read Holding Registers from id 1 and id 2. 30 words from 3002, not only id 2.

 

Hey @StarkJohan
I'm fairly sure my Evoheat heat pump has the 2AC32I12WO1 board. It has a second RS485 connection that behaves normally and works with all the Modbus commands posted earlier in this thread. I'd open it up and have another look