Numerous FirePower DCE2_EVENT__CO_BAD_MAJ_VERSION (133:27:2)

[MarkKruse5137]

Not sure if this is from a FirePower update, but...

Recently we started to get numerous DCE2_EVENT__CO_BAD_MAJ_VERSION (133:27:2) messages from Firepower Management Console. These messages indicate a source of our internal email relay going out to O365, but I'm not sure if it's the email message or something else causing this.

Can't seem to find much help on this issue.

Anyone else experiencing this?

Thanks for any help

[AnthonyLay1563]

Trying to work on getting a packet capture.  In the back of my mind I'm wondering if this is related to SUNBURST.  It started increasing in October.