Hello Cng,
Since the issue is intermittent, it's tough to reproduce. Try fiddler trace and Outlook ETL logging to check if you can find more information on why the websocket close is not seen.
Also, make sure to try this with simple policy rules not with many conditions and rule checks to avoid complexity delays.
Check the dlpwaitonsendtimeout regkey seconds value and set it to a longer duration if evaluation is taking time than the configured seconds (Ideally, in this case you should get a Send Anyway button).
If the above doesn't help, try to gather the traces and reach out to support: https://support.microsoft.com/en-us/contactus#!
*
If you found the information above helpful, please Click Yes. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.*