Hello @rstellma
I see that the status & access of MongoDb was checked.
I need to ask a couple question about rebuild that was executed. Just to make sure , you are aware that all settings and configuration metadata are kept in MongoDb & Graylog is just the from end?
Was the MongoDb nodes deleted and then rebuild from the ground up or did you save the databases from each node and installed them back?
What does the rest of the log file look like? If you restart Graylog service and tail -f the log file is it possible to post that here?
How about Firewall, SELinux/Apparmor are any of those enable?
I know this will sound redundant but have you tried shutting down Graylog services, rebooting MongoDb services and starting Graylog service back up? Then tailing GL log file when it starts up. This kind of shows a clear picture on what is going on.
Did you see anything in the MongoDb log’s?
Was this rebuild to Upgrade MongoDb instance?
Could you explain in greater detail how this environment is set up. From what I get is you have three nodes with GL/ES/ and MongoDb on them is this correct?
EDIT:
Out of curiosity what does the status of Graylog look like?
systemctl status graylog-server
EDIT:2 I noticed you have a http_bind to 0.0.0.0, are you using a load balancer in front of this cluster (i.e. nginx)?
Just doing some research on this issue, I found this posts below, Notice the logs file that was posted? looks very familiar 
but your log tends to be from Mongo.
And here