regarding ROKU_ADS_EXTERNAL_IP - this is tricky but i think i know the answer! i believe you have LAT selected (limit ad tracking) in Settings > Privacy - that's one of intended results.
the other thing i'll have to guess if i understood you - seems that 1st URL you gave was returned as part of calling first the 2nd URL? i.e. returned VAST had a wrapper pointing to a new URL. Well in that case, this is clearly a problem of that ad server (#2 URL) - they have returned invalid URL:
http://(some domain)/vast2?adtype=video&compMode=and&dim=101&z=1r&w=1920&h=1080&ip=ROKU_ADS_EXTERNAL_IP&ajuseragent=Roku/DVP-9.10 (049.10E04111A)
clue: unescaped space chars are never OK in URL (should be %20 or +)
i figure that ad server is using the value that was correctly escaped (by RAF macro &ua=ROKU_ADS_USER_AGENT or you) but when they substituted it in XML, they did not escape it
