It's good news that the shares are available via the web client - this generally means that appliance to storage communications are working well.
Given map points direct to SMB work OK, but DFS paths are intermittently affected, it cannot be related to TLS settings (which would result in the client not logging in and being white icon / green with red cross depending on cached session token)
Also, given the fact that DFS map points appear to be working OK with other clients, it seems this issue is specific to the Windows client.
Can you test with a 4.1.171 client to see if the issue is still reproducible (This sounds like a known issue which is currently under investigation, our ref Unable to access files on SMB share since upgrade )
Ivanti Technical Support