,

Can you elaborate on the comment "user client traffic is acting as DPOP traffic"?  The client itself should not be causing high bandwidth utilization unless there is an underlying network issue (retransmits, constant tunnel reestablishment, etc) as the client is simply acting as a TLS tunnel and tunneling user/machine generated traffic to Netskope.  I'd ensure that packet captures at the local client and edge network device are taken to see if a specific client/user are responsible.  I'd also be happy to review the support case if you want to direct message me the details.

Thank you.