SMTP blocked for client, multiple IPs devices and locations

I have one client that has about a dozen email users, they complain their email on their devices says can not connect to server.
I troubleshoot and find they have ended up on the IP list in the firewall
I whitelist them and their email goes through fine, BUT within hours or days, the issue has recurred.
ALL devices seem to be configured correctly and email works fine if I drop the firewall...
What could be causing this from their end? (I have MANY clients with way more email accounts and NO issues...EVER)
As they move around and use many devices, it could be just one device causing this issue, but what could the server be seeing that would cause it to add the IP?

Hello,

Use `grep` and search details in system logs.

Doesn't your firewall have a log like Configserver Firewall does? Which has entry's in lfd.log with block reasons.

If your firewall checks for login failures, ask around if one of your users is using an old version of Apple Mail (like from Apple 9 or X). I had issues with 1 user with this as pop3 worked great, but the old version always made several connections (like imap and multiple ports), hence got blocked in the firewall.

If you use SSL for your smtp it can also be old clients. For example we had a customer on another server, which still used a 2008 version of Windows Exchange Server. Which was incompatible with Letsencrypt SSL. This because visible because after we installed a new Cpanel server with more security (no popb4smtp and ssl obligated for mail), the log spew ssl errors for this client. This ended after removing the obligation to use ssl for mail.
The firewall blocked if for too many login attemps.

It might be one of these things could be causing you trouble too?