I didn't  fully investigate why it happens and is it DNN core issue or my custom code, but the current UrlRewriteModule code doesn't handle it properly. I've created the function that will read only the first parameter and ignore the rest. 

        'call     PortalId = GetIntFromQueryString(Request, "portalid", PortalId) '14/3/2006

        Shared Function GetIntFromQueryString(ByVal Request As HttpRequest, ByVal key As String, ByVal nDefault As Integer) As Integer

            Dim nValue As Integer = nDefault

            Dim sQueryStringValues As String = Request.QueryString(key)

            If Not (sQueryStringValues Is Nothing) Then

                Try

                    nValue = Int32.Parse(sQueryStringValues)

                Catch

                    'By some reason (not fully investigated) sometimes QueryString has the same parameter inserted more that once,

                    'e.g "PortalID=0&PortalId=0" so QueryString(key) will be "0,0"

                    Dim asValues() As String = sQueryStringValues.Split(","c)

                    If asValues.Length > 0 Then

                        nValue = Int32.Parse(asValues(0))

                    End If

                End Try

            End If

            Return nValue

        End Function

I noticed that DNN Support has a few bug reports with exception “Input string was not in a correct format” (here, here, here and here) .May be some of them are caused by the same reason as mine.