A change was made to have links in our emails changed from a token-based format to JWTs. After enabling this feature in production we started seeing a percentage of errors on our servers about not being able to decode the JWT as it was not valid. Looking at the invalid JWTs they appear to be totally different than what we were sending out (not even a subset of the JWT appears to be the same). Our best guess is something along the way was mangling the base64 encoding of the token parameter in our URL querystring. Every invalid request came from an IP associated with a "Microsoft Corporation" data center, widely spread across the US, not just a single data center or two. Also the user agent is predominately windows, although we have seen one or two linux. Interestingly no errors from OSX yet.
Is there some kind of link prefetch/virus scanner/etc somewhere in azure/microsoft/outlook/live.com land that I don't know about that may be causing this?