Thanks a lot for the explanation. At the moment the Cisco default route is to forward to EXT_IF so that explains why everything is working with just adding forwarding rules on Untangle.
The port is indeed 514, so I added a rule to forward that port to 192.168.158.100. I'm now getting messages from my switch (192.168.158.60) which must have been configured to an invalid host, been getting sent to the gateway by the default route, and is now getting hoovered-up by that rule and sent back to the Syslog server. But nothing from the router, should it be working at this point? I've checked the router and it's pointing at 192.168.158.100 port 514 UDP.
And thank you for all your help so far on troubleshooting this!