Seeing what the real destination is when connecting to a wildcard proxy

[Systemgeek2]

I have Fortigate 7.6.2, FortiManager 7.6.2 and FortiClient EMS 7.4.  

We are switching over to ZTNA and I have created a wildcard.example.com proxy for port 443 that most users see.  I have another wildcard.test.com proxy port 443 that is not seen by most people yet I have a few users that have some background process that is trying to access something that matches wildcard.test.com on port 443.  This connection fails and floods the user with ZTNA error 65 popups.

The 2 users are running Macos so I got a copy of the logs but I am not seeing the real URL they are trying to access.  Only that they are trying to match the policy for wildcard.test.com proxy port 443 and its failing.  I see the same thing on the Fortigate.

Is there anyway I can see what the real url is they are trying to go to?