We had this exact same issue. I had to add the addresses of our GlobalProtect gateways into a Network Location group. I then added that group as an exception in our Steering Configuration. After that, everything was stable.