Automatic investigations are failing

my client is seeing many failed AIR jobs in the protection.office.com Investigations page. These are typically for "Mail with malicious user is zapped" investigations. Has anyone else seen this? any idea why it would be occurring?