First, best practice woud be to have all of your SIEM applicances running on UTC time. Also, if the ESM is pulling time from an NTP server, have you ensure that it was properly configured? Is the ntpd service running on the ESM?
From there, like you said, user time is adjusted on each account. Additionally, you can take advantage of the Time Delta feature in 9.5.0 to determine if your data sources were configured with the wrong time zone, which is a very useful feature. Not sure if I was able to help or not but hopefully I provided some insight.
What was the solution to the Daylight savings Time Delta issue with McAfee SIEM and data sources go into it? Today the time change backwards (1 hour back) and I am experiencing the same issue. So what I did is Edit the Source and "Write" it and it figured out the correct time. What a pain; this should be automatic.