We are sending e-mail to users with 2FA. However, sometimes these emails are sent using correct html  and sometimes they are sent as plain text. See both images for the difference.

Both have been sent on the same day, different users, from the same email provider using the same application and therefore also the same configuration.

Where does this behaviour come from? Do I have to look at the email provider, our system administrators or is it something within the TW application?

We are using Office365, TW platform 2021.2, webgui 2021.2.17 all hotfixes applied until 20211001 - Exclude deeplink process flows.