I took the code from the registrar.  It is scanning all the Contact headers until it finds one that has an instance_id parameter,  I think this is because we saw some situations where a single REGISTER could contain one Contact header with expires=0 and no +sip.instance parameter and a second Contact header with a non-zero expires and +sip.instance.  Since this code is looking at a single REGISTER request, all the contact should be from the same endpoint, so it doesn't make sense to filter them in any way.  Also, there can only be one Instance-ID AVP according to TS 32.299.