Hello,
How do you know that a specific rule is being hit for users not called in that rule config? Do you see events with the source ip/username being seen for a specific group in the 'table view of connection events'.
Can you show a snippet of the rule you are talking about. Ideally, if there is no match, the default rule is hit, maybe thats where the traffic is going.
HTH
AJ