For NAT (Network Address Translation) or any other packet header modifications, you need to recalculate checksums manually

Why doesn’t checksum offload in the NIC take care of that?

And I'm confused how they have to correct the TCP checksum but not the IPv4 header checksum...