Are the users connecting to the Storefront directly, and then having Optimal Gateway Routing have them going to Gateways? Or does the workspace App talk directly to the gateway and never see the storefront url.
I have seen this if the Storefront URL is the same as the Gateway URL. So what I do to mitigate it is set the Storefront URL to a different address, and set the beacons to be non-accessible so that it will never try and connect to the storefront bypassing the gateway. Now Workspace will still cache some information, so if the Storefronts are not replicated together the IDs in the cached published resources won't match to the new storefront, so it will require either a refresh, or a full reset.