Summary: in your case, mTLS alone suffices for client authentication; but in principle, the pen-testers' suggestion is not invalid
Based on the details provided in the question and your comments (here and here), this is your setup:
- there are two applications that talk to APIs
- each application has a different cert for each API that it talks to, no cert is shared between the applications and/or between an application and any two APIs
- no application acts as a proxy to other applications
- you're using mTLS as a means to authenticate the peers (clients/servers)
Since each cert is unique per application per conversation (app <-> API), it can be safely used to identify each application; there's no need for another layer of authentication.
Concerning the suggestion from the pen-testers, I'm not sure whether they based it on any info not present in your question, or they provided it as a general remark/best practice. However, in principle, there is a foundation for it:
(m)TLS does not operate at the application (OSI) layer, which means that when it comes to application-level logging, getting authentication info per request isn't straightforward. This is a problem when it comes to incident response and forensics. Adding an application identifier that will "escord" each request, will make your life easier. This application identifier usually comes under the umbrella of authentication, because it should (ideally) be pre-approved before it's used (e.g. an API key or access token)
there's the concept of multi-layer (or multi-level) authentication (MLA)1. MLA suggests that you should use the same single factor authentication multiple times when a subject requests access to objects. MLA is used extensively in physical security (e.g. an employee accesses restricted building areas by using his id card to open each door leading to each restricted area, after he uses his id card to enter the building). MLA can also be used in cases where there's a TLS termination proxy between a client and an API and you implement zero trust security; there can be an initial client authentication using mTLS, but (because each client request is forwarded to the internal API) the API also has to authenticate the request origin before serving it
Nevertheless, it's clear that the last point does not apply to your case (I'm not sure about the first one, either). So, I don't see how the suggestion is relevant to your case, nor how beneficial it would be to add another layer of authentication.
1 See here (link to a blog page of a company that I'm not affiliated with) and here for explanations on the concept of MLA