bytes in flight higher than receiver window

edit

I am dealing with sort of a "ghost issue". We have an endpoint that some people can use at all times with no issues but others have a frozen connection on the client side that never finishes while server can see reset connection. I have captured traffic over network that works and it's perfectly synchronized and I can see when the sender gets close to the receiver window size it backs down while the network that fails the Bytes in flight go 3-4x over The calculated window size. To make things more confusing we have 2 different endpoints with similar set up and there is a one that causes the issue and another that can handle it all. (The only difference is the VM type used on the cluster).