You are correct when you say an ARP request is not addressed to the "Broadcast IP Address" of a particular subnet. So at no time were your ARP "broadcasts" destined to .7 or .15.
Let me try to explain why I said Proxy ARP is required for this to work. Lets assume everything is properly configured, and we'll use the 18.104.22.168/28 network for the example:
Your Firewall owns the IP 22.214.171.124, of the 126.96.36.199/28 network. Your Firewall's default gateway is 188.8.131.52, which is owned by the upstream router. You have three static NAT's configured for servers behind your Firewall, they each own the IP 184.108.40.206, .4, and .5. The server's internal IP addresses are 10.0.0.3, .4, .5, respectively. For this all to work, Proxy ARP must be enabled on your Firewall. Here is why.
Your Firewall (220.127.116.11) can respond to pings. This is because when I ping your Firewall's IP, Routing takes it to the upstream router, who then checks its Route Table and realizes the 18.104.22.168/28 network is directly connected. As a result, it issues an ARP Request for the 22.214.171.124 address, to which your Firewall replies with its MAC address as the 'owner' of the 126.96.36.199 address.
Now if I ping your server, at IP 188.8.131.52, the same Routing will also take it the up-stream router, who will yet again notice that the 184.108.40.206/28 network is directly connected. So the Router issues an ARP Request, looking for the MAC address that 'owns' the IP address 220.127.116.11.
Your server, who is neither on this network or configured for this address, is unable to respond to this ARP Request. Something else must Respond to this ARP on behalf of the server, who is indeed the true owner of this IP. Your Firewall now comes to the rescue, and answers the Up-stream Router's ARP Request with an ARP Response, providing the Firewall's MAC address as the owner of 18.104.22.168. This allows the Router to encapsulate the packet in a way that gets it to the Firewall, who can then forward it to the Server's real address (10.0.0.5).
Without the Firewall issuing a Proxy ARP to respond to the Up-Stream Router's ARP Request, the Router has no way of knowing to send the packet destined to 22.214.171.124 to the Firewall.
I was going to post this initially, but when you said everything is now working with Proxy ARP disabled, I was rather confused. Because in fact, it shouldn't be. Could you post the relevent portion of the Router's "show arp" entries for the Firewall and Server IP addresses? The ones equivalent to the 126.96.36.199, .3, .4, and .5 addresses from my example above.