This message was deleted.

I would take a look at that specific user instead. Why is that user making tls1.1 calls, when everyone else is using tls1.2/1.3.

Thats 7.15 LTSR version. By default does that version use tls v1.1?