Question: plone.protect and varnish / @@confirm-action raised without reason

Dear community,

we use Plone 5.1.5 with plone.protect 3.1.4 and varnish. Now our client told us, that he sometimes get a @@confirm-action without a visible reason (and it is not reproducible for us). Does anyone here ever had this kind of problem (especially with varnish) or could it be, that this is just one of the cases @djay mentions here in another post:

Is there a reason why you suspect and ask for the use of Varnish having something to do with this?

Dylan's message is focussing on the first GET request to a fresly installted Plone site that might trigger a database write.

We suspected that the varnish could have mixed up authenticators for example, but therefore we can't safely reproduce the issue we are now looking for any clue.

Did anyone can help with a suggestion why the confirm_view keeps popping up without visible reason? The logging we did wasn't really helpful for now