In order to anlayze the details i would suggest you to do the following steps:
1.Get the message header of some emails and share the same(
https://support.office.com/en-us/article/view-internet-message-headers-cd039382-dc6e-4264-ac74-c0485...)
2.run a message trace from exchange admin center by adding the recipient email(affected user):
https://docs.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/run-a-message-trace-and-...I have attached the links for the steps to run a message trace and get the internet headers of an email(make sure your are getting the header from the user inbox not a forwarded copy of the same email)
Once you have the above two informations kindly share the same.
(Note: please do not mind the spelling mistakes)