do you see traffic in the access.logs at all? What happens when you access a web site that should be blocked? Do you see any error message or the website itself?
I think, This issue is connected to GTI too ( Webgateway 22.214.171.124.0 slow internet ) which is already solved.
You can check the MWG-ERROR and if you found some timeout error in there, you have to disable GTI from Antimalware and DCC engines.