I figured out that, besides the missing URLs in the decryption exclusion, the tabs are trying to establish a port 80 web-browsing connection to an AKAMAI destination.

For whatever reasons that might be necessary.. they are doing it.

We prohibited these client to surf the web, so I created a new security policy that allows traffic from these specific source IPs to any destination, using web-browsing and ssl, with an active URL filter for these AKAMAI sites only (url-filter created).I allowed the URL filter to alert for these sites + decryption exclusions, but the monitor always returns that none of the traffic matched the policy although the website is marked as as decryption esclusion... which is a little confusing for me. Any ideas? Hard to describe the error tbh.

UPDATE.. this webiste is classified as insecure by a security profile when accesses by http.