Is it always the same users? Are they trying to use the API?
If it’s not and they aren’t then check the profiles of some affected users, do their IPs look accurate? Are they all the same or similar? If so it’s either a misconfigured reverse proxy or something like Cloudflare being used with the orange cloud enabled without the template specified in the YML.