[pbnjay]

Sounds like it could easily be the Cisco umbrella junk a few gov/universities have had that I’ve seen. They install MITM CAs[0] on managed hardware so they can definitely see page content.

[0] https://docs.umbrella.com/deployment-umbrella/docs/install-c...

Edited to add link to docs.