SMP logs are flooded with warnings - "Certificate worker call rejected: performed with invalid certificate scope by request: xxx.xxx.xxx.xxx" (the Internet Gateway server).
Clients do not seem to be stopped at the GW server.
Release: 8.6
This has been reported to Broadcom Engineering.
This will be addressed in the next cumulative Pointfix v10 for 8.6 RU3 (to be released in the next couple of weeks along with several other fixes) and in 8.7 RU1.