Percona Cluster Failed with Haproxy : Connection Limit Exceeded
OBSERVATION #1
You have max_connect_errors to 1000000 (One Million). If you ever reach that many consecutive connection failures, you would simply run FLUSH HOSTS; to clear up blocked connections. Given the high value of that setting, you will never need to run FLUSH HOSTS;
OBSERVATION #2
I am glad you mentioned your TIME_WAITs. I wrote this post in ServerFault back on Feb 01, 2012 : MySQL lowering wait_timeout value to lower number of open connections. This is a bit of a hack but it is a necessary evil in this instance.
In short, just run this on every PXC node
SEC_TO_TIMEWAIT=1
echo ${SEC_TO_TIMEWAIT} &gt; /proc/sys/net/ipv4/tcp_tw_recycle
echo ${SEC_TO_TIMEWAIT} &gt; /proc/sys/net/ipv4/tcp_tw_reuse

This will  make TIME_WAITs timeout in 1 second. You have to run these lines every time a node reboots.

I got this idea from this post: How to forcibly close a socket in TIME_WAIT?
The accepted answer has a pictorial representation of when a TIME_WAIT comes into existence.
The answer with the idea that I liked is the one I am now suggesting.