Routing – How to use secondary internet exclusively for one host

You do have asymmetrical routing, but that shouldn't be the issue. Instead, I suspect the issue is link delay involving your 3G link. Since IPSec IKE uses UDP/500 or UDP/4500 with NAT-Traversal, there's no guarantee of packet delivery. Your VPN client -- the IKE initiator -- sends the first IKE message and is awaiting a response from your ASA. The ASA IKE response message is either dropped or delayed too long that your VPN client sends another IKE message, causing the ASA to log the Duplicate first packet received.

I would think your DSL link is more reliable -- less delay, less jitter, less packet loss -- than the 3G mobile network. Any reason that's not your default gateway? To test the 3G link as the issue, force the DSL to be your default.

At the risk of another down-voted answer because I can't comment I'm going to propose a possible solution.

The Problem:
The forwarding address of the Type5 LSA is non-zero. According to the Cisco docs and RFC2328:

If the forwarding address is non-zero, look up the forwarding address in the routing table.[24] The matching routing table entry must specify an intra-area or inter-area path; if no such path exists, do nothing with the LSA and consider the next in the list.

Because:

[24]When the forwarding address is non-zero, it should point to a router belonging to another Autonomous System.

I believe when it does that look-up and sees the next-hop address is a connected route it is skipping the LSA and not installing it into the route table. I think this is quite a literal interpretation; I would consider a connected route as intra-area. However since it is all a single area it is still flooding the LSA on to your external router, where it sees the LSA's next-hop as an OSPF route advertised by the MLS and therefore installs the LSA into the routing table.

According to your post and the Cisco doc:

These conditions set the forwarding address field to a non-zero address:
OSPF is enabled on the ASBR's next hop interface AND
ASBR's next hop interface is non-passive under OSPF AND
ASBR's next hop interface is not point-to-point AND
ASBR's next hop interface is not point-to-multipoint AND
ASBR's next hop interface address falls under the network range specified in the router ospf command.

Possible Solution:
So according to this information if the ospf network type is set to point-to-point between the ASA the MLS then the LSA's next-hop should be set to zero. This could be checked beforehand by show ip ospf interface; it is probably at broadcast currently.

On both devices you would need to set the interface OSPF network type to point-to-point and also statically define the neighbor under the OSPF config.

You should then see the Type5 LSA next-hop address set to zero and

If the forwarding address is set to 0.0.0.0, packets should be sent to the ASBR itself.