Correct. All the websites where I see this error have sucuri running with salts being reset periodically. This has not been a problem in the past so I guess you improved the app which now interferes with sucuri.
And in reaction to your earlier comment. That is the method I used to solve the issue for each user that was affected. By disabling 2FA and letting them set it up again.
Thank you for clearing up the cause of the issue! I guess I’ll have to choose which plugin I’ll replace for another now.