Signed installer package failing on some machines

We have a signed, Apple notarized installer package (using our Developer ID Installer certificate) that works fine for all our users except every now and then we get complaints that the installer fails to install and shows an error:

The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance

After inspecting the affected users' Console logs, we find the following just before it fails:

I have no idea what we need to do to fix this. Looks like the intermediate / root certificate on their machine is either invalid or does not exist. What should we do?

Code Block
default 21:16:26.843274 -0700 trustd cert[2]: AnchorTrusted =(leaf)[force]> 0\
default 21:16:26.851127 -0700 trustd cert[0]: ExtendedKeyUsage =(leaf)[]> 0\
default 21:16:26.854118 -0700 trustd OCSPResponse: single response has extension(s).\
default 21:16:26.855599 -0700 trustd asynchronously fetching CRL (http://crl.apple.com/root.crl) for client (Installer[56617]/0#-1 LF=0)\
default 21:16:26.855677 -0700 trustd cert[1]: IntermediateEKU =(path)[]> 0\
default 21:16:26.856932 -0700 Installer Trust evaluate failure: [leaf ExtendedKeyUsage] [ca1 IntermediateEKU]\
default 21:16:26.858617 -0700 trustd OCSPResponse: single response has extension(s).\
default 21:16:26.862765 -0700 trustd OCSPResponse: single response has extension(s).\
default 21:16:26.866303 -0700 trustd OCSPResponse: single response has extension(s).\
default 21:16:26.873600 -0700 diskarbitrationd <private>\
default 21:16:26.873655 -0700 diskarbitrationd <private>\
default 21:16:26.873697 -0700 diskarbitrationd <private>\
default 21:16:26.874035 -0700 diskarbitrationd <private>\
default 21:16:26.874062 -0700 diskarbitrationd <private>\
default 21:16:26.874115 -0700 diskarbitrationd <private>\
default 21:16:26.952296 -0700 kernel obj_checksum_verify:4349: failed: cksum 0xa7da628a7a3b79d3, oid 0xd6fe574d92b7eb96, o_xid 0x7f14df7fdd07fa7f, o_type 0x3fdbf6a, o_subtype 0x8aefbfee, size 4096\
default 21:16:26.952309 -0700 kernel nx_corruption_detected_int:60: Corruption detected by obj_checksum_verify:4357 in container C43C9696-C544-4AA8-94FD-0E8841362A66!\
default 21:16:26.952313 -0700 kernel obj_read:4043: oid 0x4000000ebab9a flags 0x40000003 0x0 type 0x40000003/0xb paddr 0x4000000ebab9a error verifying checksum\
default 21:16:26.952324 -0700 kernel apfs_vnop_write:7501: fs_map_file_offset failed on ino 2449570 (MicrosoftRegistrationDB.reg) 2756608:1 ret 92\
default 21:16:26.981230 -0700 Dock 27366555: RECEIVED OUT-OF-SEQUENCE NOTIFICATION: 0 vs 555, 563, <private>\
default 21:16:26.984018 -0700 distnoted register name: com.apple.speech.synthesis.TalkingAlertsSyncWithPrefsNotification object: kCFNotificationAnyObject token: f4394 pid: 56617\
default 21:16:26.985710 -0700 Installer The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance.\