Since users are already ingested into Moveworks and ACLs and Bot Access Rules are verified, I would focus on the ServiceNow ESC configuration and authentication flow.
Compare a working and non-working user, checking the browser console for any 401/authentication errors, validate the ServiceNow JWT configuration, and check if any user criteria or widget visibility conditions are restricting access.
Also, try accessing the bot directly through My Moveworks with an affected user. If it works there but not in ESC, the issue is likely with the ServiceNow embedded bot configuration.