This is probably not exactly what you are talking about, but there was a change in granular access controls in the last 12 months, where users could grant permissions to some, but not all, of your requested scopes. Could that be a factor? Where a user denied permissions to a narrow scope while granting access to others and that's causing an access issue?