Adding to the steps that Jimmy posted which help coming up with the solution, I also found another scenario for a couple of my clients. Both clients in question were not originally setup by me, and when I looked at their domain health in the admin center - Settings - Domains - I found their "onmicrosoft.com" domain was set as default. So when I look at the email message header details, I found a DKIM signature that references the onmicrosoft.com domain, which I believe is contributing to the issue because the email is signed that it should come from an onmicrosoft.com email address, but it is actually coming from their domain address.
So I updated the default domain to the custom domain that they use, but the DKIM signature is still there after about an hour. Not sure if I just need to wait longer, or if I need to do something to force it out. From the message header, this is what I see -
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=XXXX.onmicrosoft.com;
s=selector2-XXXX-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
Anyone know if I'm on the right track that this is a contributing factor to the issue? SPF records are correct and in place.
-Brad
EDIT - I also found if you go to the Security Admin Center - Under "Email & Collaboration", click on "Policies and rules", Threat Policies, Email authentication settings, DKIM tab - the clients with the issue had DKIM enabled for the onmicrosoft domain. (whereas my clients that didn't have the issue did not have it enabled). I just tried disabling that for the onmicrosoft domains. I'll give it a bit and re-test.