OK so the failures are occurring over IPv4 netmaker IPs, eg: 100.100.100.1. If it happens to try the IPv6 NM address (eg: via DNS), or if I just use the IPv6 address manually it works fine.