Why would users of a specific application get locked out of AD after one bad password?

We have a group of about 25 users that use an application that relies on their AD credentials to authenticate. For some reason (and this has been going on for over a year now), when they try logging into the application and they do not enter their password correctly, it locks their AD account after a single failed attempt, and they need to call in to have their account unlocked. I've gone as far as viewing the audit reports in our Netwrix auditor and see that at the time they lock out, it shows they had three failed attempts all at once, even though they only manually entered a bad password a single time. If this was a single user, I could see it being user error, but the entire department has had this issue and every time it is the same story - they mistyped their password once, and their account locked out. We receive a few calls daily to unlock an account from thsi department. I don't know if this is something specific with the one application they use, or if there are other applications known to cause this to happen and what a fix might be. Has anyone seen something similar or have an idea where to look to see what might be causing this for users? (We did have a period of time earlier this year where our root CA server was offline for a few months, and we did not have the lockouts occur, but that could just have been a coincidence, so I don't want to throw anything misleading into the mix, but wanted to mention this)