If they only (and consistently) get that after logging in, then it sounds like there's an add-on at play.
However, if you are behind a reverse proxy system (such as CloudFlare) and you haven't applied patches to have XF use the real IP, it sounds like you've likely banned a proxy IP and some users are randomly (or not so randomly) using that IP.