Event ID 56 TermDD

The Terminal Server security layer detected an error in the protocol stream and has disconnected the client.

Has anyone come across this and know what this means? from what I can gather from users at remote sites (hardware VPN) they freeze and then it attempts to reconnect - after a minute it reconnects back to the session. Could this be a license cal issue?

Thanks