I think we finally figured this out. Note 1732610, Section 2.2 mentions a little blub about the importance of the "local intranet zone". for us, it was the exact opposite, once I took the hostname OUT of the zones, we have worked just fine. Our company has a policy setting, so no users can alter what goes in these zones. Unfortunately, that wasn't as consistent across all users as I was told.
But again, once we cleaned up those entries we have not had the problem.