I have noticed that Sophos 16 seems to have a problem with the way it’s captive portal works. If enabled (firewall policy set to drop), it seems to generate excessive amounts of traffic over my links to the remote branches. Screenshot below shows the traffic when captive portal is enabled, and you can see the massive