Some endpoints fail to authenticate to KDC Proxy - most work as expected

Hi all. I've got a real headscratcher here and I'm out of ideas, hoping someone can give me some direction on where to investigate.

Background: We recently rolled out a web-accessible KDC Proxy as a first step in a larger project. We tested this on about a dozen endpoints and had no issues for several months, so we moved ahead with the launch - only to find that about 20% of our endpoints are unable to log in when the proxy configuration is live, and the proxy is reachable. If they have direct LOS to a domain controller or are offline entirely, they log in normally or use cached credentials as expected, the problem is restricted to situations where the proxy would be utilized for login.

Behavior: Endpoints attempt to log in, and sit on the "Welcome" animation, seemingly indefinitely (we have tested overnight and none of the affected machines logged in in that time). Traffic inspection shows the endpoints reaching the proxy, successfully negotiating TLS, and then just sitting there. 1-2 seconds after negotiation begins, the endpoint will log an error in Security-Kerberos: "The Kerberos client could not locate a domain controller for domain OUR.DOMAIN.COM: 0XC000005E. Kerberos Authentication requires communicating with a domain controller.". During this time, the KDC proxy does not reach out to the domain controller at all, but it will do so when a working endpoint connects to it. Another way to frame this issue would be "KDC Proxy fails to forward requests to domain from some endpoints".

Work done so far:

1. This is probably not a global configuration issue with the proxy or its infrastructure, as most of our endpoints work fine and the issue seems to be specific to these endpoints, either failing to negotiate something with the proxy/domain, or being rejected by the proxy for some reason.
2. The issue is not account specific - affected endpoints are unable to log in with any account at all, but the same accounts on other endpoints work as expected.
3. We have not identified any pattern with missing Windows updates or versions of Windows so far - we even found a rogue Windows 10 machine still in the wild when the user reported the problem.
4. The proxy shows no errors or issues in its logs, suggesting that the problem is on the endpoint end
5. This is very unlikely to be related to the proxy's certificate configuration - the proxy has a certificate issued by a publicly signed CA, and navigating to it manually in a browser on the endpoint shows that the certificate is trusted and valid
6. Ruled out packet inspection/other firewall issues - disabling Windows firewall entirely and shutting off all incoming traffic inspection on the associated firewall policy changes nothing
7. Issues with the affected endpoint's AD objects - they appear to be identical to working ones in all respects.

There is very little information out there about the inner workings of the KDC Proxy feature, and given how bad Microsoft support has gotten, I am not hopeful that our support case with them will be productive. I'm hoping someone has an idea for me to chase down.

Thanks in advance.