Gathering SymDiag logs and rehydrating them, we found one TLS session that failed to complete successfully (Fatal TLS alert generated by client, with Certificate unknown description after receiving the Cloud SWG server certificate). We added this to the bypass list and all worked fine.