Health status Suspicious

I'm finding a few endpoints showing in the plugin with Health Status "suspicious". When I check Sophos Central everything is fine. This is generating a ticket in our PSA system and wasting tech time.

Digging deeper, the LastSeenAt field in the plugin_sophos_central_cd_endpoints table is not current, and doesn't update after a sync. I assume this is why the plugin is noting the status as suspicious. ThreatsStatus and ServicesStatus are both 'good'.

The LastDataSync field on the plugin_sophos_central_cd_endpoints table shows the current date, and updates if I do a manual sync, so something is syncing.

Apart from this and also being very slow with 2000+ endpoints, the plugin is working okay

Any ideas on the health status isse?

Thanks

James