Based on the answer, I found one of the client specify the NPS server using
its NetBios name, which would be resolved as both internal and external
addresses (since the NPS server has two NICs). I changed NetBios name to the
internal address. And it seems the issue has been solved. Thanks.