I have administered Zscaler and I bet the issue is that Zscaler is doing TLS MITM and every windows machine joined to the domain is configured to trust the Zscaler wildcard cert used for every site. This usually just works for anything joined to the domain but the cert has to be manually trusted for anything else. And yes it is amazingly annoying. I try to write a script or bake the cert into an OS image.