CAUSE 1: Dynamic DNS was being used.
CAUSE 2: Internet Explorer 11 handles cookies sessions differently.The issue also seems to only affect IE11 (e.g. Chrome and Firefox work on the same machine)
Use static DNS for the Cloud Access Manager servers.
The protected mode needs to be enabled on the end user machine, with all CAM hostnames being within the same zone (be it intranet or trusted sites etc.)