firewall blocking traffic randomly

hello,

we face an issue at our company that is very frustrating because it rarely happens but when it happens we don't know why and how it gets resolved because after a while it get fixed without interfering. it might happen twice a week, and every time with a different employee where all the browsing gets blocked by the firewall suddenly. it works if we bypass the rules for the employee, or if we keep everything as it is it works after few hours without changing anything. the strange thing, that when this happens, we always try a policy test for that specific employee where everything is allowed by sophos but when it comes to browsing we find the sophos logo blocking the website - e.g: google.com - 

also, we always make sure that the employee belongs to its corresponding AD group.

does anyone faced similar issue?

Regards,