As rseibert notes, the debugs show there is no nat on the traffic. You mention that the SSG is uing interface nat mode instead of route mode. I don't remember if that shows up in the debug or not. If you could run the test again after the restore to verify that would be helpful.
You also mentioned that static addressed devices worked during the incidents. Do the policies that handle these priviledged users include nat on the policy in the advanced tab?
If we suspect that interface nat is involved here it is pretty simple to add the source nat on interface to the advanced tab of all your internet policies then switch the mode from nat to route on the interface.
I also note you are testing with access to 8.8.8.8 as the internet source. And this seems to be getting responses in the logs. Are you testing to this because DNS is not working? Is this your DNS server for the site? Does nslookup work when the issue occurs then?