Are you on PAN-OS 8.0+? Any reason for the block-continue action in the first line of your logs? We saw a similar issue after moving to 8.0.2 where URLs that were properly categorized were still getting the 'unknown' block-continue treatment. We remedied this by creating a new Profile Setting where the 'unknown' category is set to allow. Will be opening a TAC this week, but this was slowing down mail flow and we saw an instant remediation on creating the new profile.
... View more