FYI the fix for my issue is adding the following to /etc/postfix/main.cf
tls_eecdh_auto_curves = prime256v1 secp521r1 secp384r1
Apparently there is some change in latest OpenSSL that causes issues with TLS establishment and restricting to the allowed curves fixes the problem.