We have seen this once before, but the cause was actually an issue with the web server itself.
There are various mitigations to prevent against it in the code, but what can sometimes happen is the sitemap creation is interrupted, perhaps due to the web server restarting, PHP restarting or other similar server problem and it leaves the sitemap creation in an inconsistent state which can cause an incomplete or corrupt XML file.
One mitigation of this issue is to disable the built-in sitemap Cron entry and instead create a server crontab which runs php cmd.php xf-rebuild:sitemap
periodically.
This was found to reduce the problems which, really, only went on to prove there was something in the web components on the server that was problematic but the customer in question, I believe, still rebuilds the sitemap in this way rather than relying on the built-in XF cron.
I'll leave this open (albeit as a troubleshooting thread) but it isn't clear at this point whether a bug exists.