Intermittant errors opening office documents in the browser - Office Online Server and Sharepoint Subscription Edition

Intermittently our users are getting the error:

Sorry, there was a problem and we can't open this document. If this happens again, try opening the document in Microsoft Word.

Session ID xxxxxxxxxxx

This occurs when opening office documents in the browser. Either directly from sharepoint or via a "Share" link.

We have 3 other sharepoint environments (1 x Sharepoint SE and 2x Sharepoint 2016) integrated with this OOS farm and none of them have the same issue.

Documents open ok in desktop application (rather than the browser)

Closing the browser, clearing the cache and trying again often resolves the issue but not in all cases

SharePoint server has January 2023 CU

Sharepoint farm is running Kerberos authentication

Logs from the OOS server show:

WOPI CheckFile: Catch-All Failure [exception:Microsoft.Office.Web.Common.EnvironmentAdapters.WopiUserUnauthorizedException: WOPI 401 ---> System.Web.HttpException: Unauthorized -

-- End of inner exception stack trace ---

at Microsoft.Office.Web.Apps.Common.WopiTalky.AddHostResponseDataAndThrow(Exception exception, HttpRequestAsyncResult result)

at Microsoft.Office.Web.Apps.Common.WopiTalky.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException)

at Microsoft.Office.Web.Apps.Common.WopiDocument.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException)

at Microsoft.Office.Web.Common.HttpRequestAsync.End()

at Microsoft.Office.Web.Apps.Common.WopiDocument.CheckWopiFile()]

FileUnknownException with InnerException from CheckBaseDocument, InnerException: Microsoft.Office.Web.Common.EnvironmentAdapters.WopiUserUnauthorizedException: WOPI 401 ---> System.Web.HttpException: Unauthorized -

-- End of inner exception stack trace ---

at Microsoft.Office.Web.Apps.Common.WopiTalky.AddHostResponseDataAndThrow(Exception exception, HttpRequestAsyncResult result)

at Microsoft.Office.Web.Apps.Common.WopiTalky.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException)

at Microsoft.Office.Web.Apps.Common.WopiDocument.LogAndThrowWireException(HttpRequestAsyncResult result, HttpRequestAsyncException delayedException)

at Microsoft.Office.Web.Common.HttpRequestAsync.End()

at Microsoft.Office.Web.Apps.Common.WopiDocument.CheckWopiFile()

FileUnknownException while loading the app. [FileSourceId: -1088102096] [ClusterId: 0] [ExtraErrorInfo: ]

On SharePoint server we are seeing regular 8306 errors only on the WFEs regularly but unsure if it is related:

There is no actor claim so no actor token.

SPApplicationAuthenticationModuleV2: Incoming token does not contain an actor.

Error trying to search in the UPA. The exception message is 'System.ArgumentException: Exception of type 'System.ArgumentException' was thrown. Parameter name: value

The set of claims could not be mapped to a single user identity. Exception Exception of type 'System.ArgumentException' was thrown. Parameter name: value has occured.

The registered mappered failed to resolve to one identity claim. Exception: System.InvalidOperationException: Exception of type 'System.ArgumentException' was thrown. Parameter name: value ---> System.ArgumentException: Exception of type 'System.ArgumentException' was thrown. Parameter name: value

STS Call Claims Saml: Problem getting output claims identity. Exception: 'System.InvalidOperationException: Exception of type 'System.ArgumentException' was thrown. Parameter name: value ---> System.ArgumentException: Exception of type 'System.ArgumentException' was thrown. Parameter name: value

STS Call: Failed to issue new security token. Exception: 'System.InvalidOperationException: Exception of type 'System.ArgumentException' was thrown. Parameter name: value ---> System.ArgumentException: Exception of type 'System.ArgumentException' was thrown. Parameter name: value

An exception occurred when trying to issue security token: The server was unable to process the request due to an internal error. For more information about the error, either turn on IncludeExceptionDetailInFaults (either from ServiceBehaviorAttribute or from the <serviceDebug> configuration behavior) on the server in order to send the exception information back to the client, or turn on tracing as per the Microsoft .NET Framework SDK documentation and inspect the server trace logs..

Troubleshooting steps already taken:

1. Rebuld Sharepoint farm distributed cache service
2. Confirmed the host header site collection is in the default zone
3. Confirmed the security token service is running and healthy
4. Cleared cache on OOS server farm and restarted IIS