So actually the problem turned out to be with our internal routing, I ended up hosting it on a server in Azure (with the majority of my infra on-prem), however I did work with Richard Hicks himself to troubleshoot and identify potential issues, we found that the Sophos was a red herring and actually had very little to do with it, happy to help if you're able to share some config in DMs