A company has deployed Explicit Proxy over Tunnel (EPoT) for their VDI users. They have configured Forward Proxy authentication using Okta Universal Directory. They have also configured a number of Real-time Protection policies that block access to different Web categories for different AD groups so, for example, marketing users are blocked from accessing gambling sites. During User Acceptance Testing, they see inconsistent results where sometimes marketing users are able to access gambling sites and sometimes they are blocked as expected. They are seeing this inconsistency based on who logs into the VDI server first.
What is causing this behavior?