The initial Secure Socket Tunneling Protocol request could not be successfully sent to the server

Question

I have mad situation

Server 2019 with Always ON VPN configured for both iKEv2 & SSTP (certificate from commercial CA)

iKEv2 always works (unless end user has problems with ISP/router that does not allow protocol)

SSL VPN (SSTP) works one day no issues, and fails next day. Then few days later works again & then fails again

No pattern, no logic

On client I can see:

`CoId={ADF6FFFD-330F-0001-2FAA-FEAD0F33D901}: The user machine\user dialed a connection named AO which has failed. The error code returned on failure is -2147014836.

CoId={ADF6FFFD-330F-0001-2FAA-FEAD0F33D901}:The initial Secure Socket Tunneling Protocol request could not be successfully sent to the server. This can be due to network connectivity issues or certificate (trust) issues. The detailed error message is provided below. Correct the problem and try again. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.`

On server I see:

CoId={752D3057-CBE3-5326-112D-82F585B1672D}: The following error occurred in the Point to Point Protocol module on port: VPN2-160, UserName: . The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method used by the server to verify your username and password may not match the authentication method configured in your connection profile. Please contact the Administrator of the RAS server and notify them of this error

I could understand if it works never or always, but not sometimes!

Anybody has any ideas?

Seb