Normally it is is either something that broke connection at network or host (client) level (eg. fw or av).

Thanks Hrvoje! In the past couple of months we have been installing Cylance Protect on our servers. I will look for a pattern between that and the wire wall.