Check for the "workplace join" folder in schedule tasks, we had an issue just like that a few years ago and we found a task that would run at user login and basically break licensing for users and like yours not all of them. Not saying it is it but check this folder in schedule tasks in the base image:
Demetrius Spicer
05/22/2023, 11:05 PM
Task Scheduler library --> Microsoft --> Windows --> Workplace Join
Demetrius Spicer
05/22/2023, 11:06 PM
Also check as the user, we nixed the join at login and found it was a user task scheduled not a machine task, so you might have either/or.