Forticlient EMS Application Firewall Blocking DNS

I’m using Forticlient 7.2.14 with EMS Cloud 7.4.5. All of a sudden some users are reporting that they cannon’t connect to anything (Web or corporate VPN). After investigation we found that the application firewall in our EMS profile is blocking DNS for some clients even though this same profile is working for others on the same hardware/forticlient versions. This happens off fabric and prevents even connection to EMS so users cannot then connect to the fabric (VPN). Our only path to fix was to disconnect from EMS (with password), disable the application firewall in the EMS profile and reconnect with an invitaion code. All works thereafter.

What might cause this given nothing has changed in our configuration other than EMS cloud auto-updating to 7.4.5 in early April?