We see inconsistent response in the UI (settings --> Users and Authentication --> access control --> users). Some users are not found, we know that the user recently accessed the platform. This makes it challenging to triage and review what role is being inherited by a specific user. This response and list of users can vary between search head cluster nodes that all point to the same LDAP environment.
If you have more than 1000 user information cached then it can happen. Maybe you can find different list of users for the same search string in different search head in SHC - cached users are not sync-ed among the SHC members. If you have many groups not relevant to the roles they will occupy the cache slots. First off you may want to increase the "max_users_to_precache" to, like 50000 and see if it makes any differences.
[ldap] in limits.conf
max_users_to_precache = 50000 (1000 by default)
ii)Consistently missing users with specific capabilities;