Did you check the threat vault connectivity from PA devices.
Test connectivity to the Threat Vault using:
> test threat-vault connection
or you can check it from System logs.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM0BCAW
NpN
