How much of an Applcation Control profile includes urls?

I've been building some policies to control egress and I came across and interesting situation. I was building a policy for Apt (apt-get). And it works perfectly fine. Except for when a server has an additional repository installed. These are all Debian 12. And everything works except for when the Docker repos refresh. In which case Apt starts getting back 403's and 401s. Toggling the policy on and off directly affects whether Apt works correctly or not. 

So, I'm trying figure out if this is my outbound SSL inspection policy meddling with a pinned cert or something I need to modify in my policy. 

Thanks all for the thoughts on this.