When analyzing traffic from sites, such as play.google.com, and contacts.google.com, traffic coming from a Proxy server, such as ProxySG, does not get blocked by Network Prevent for Web.
The PII in these cases is encoded in a proprietary Google format, and thus cannot be decrypted by the Proxy or by DLP.
Use Cloud Access Service Broker (CASB) to detect on this content.