Intermittent SQL Delegated Authentication Errors
If your SQL Servers are clustered, and their service accounts are configured to allow them to manage their own Service Principal Names, you might be running into a known issue.
In an environment with physically distanced Domain Controllers, a planned failover  event can cause the Kerberos delegation for double-hop authentication to fail with symptoms matching the error message in your question.
When SQL Server shutdown occurs, the SQL Server service attempts to deregister the Kerberos SPN with a Domain Controller.  Then cluster failover occurs, and the SQL Server service is started up on one of the other nodes.  This can happen quickly enough that the other Domain Controllers in the organization haven't yet received the synchronization for the removal of the SPN.  At this point, SQL Server will try to register the SPN, but can't because it hasn't yet been removed on all Domain Controllers.  As a result, the attempt at registering the SPN fails.  SQL Server starts up normally, accepting auth requests via NTLM and no one is any wiser unless someone attempts double-hop authentication.
There isn't a great solution to this, other than having permanent SPN entries created in the Active Directory domain, and preventing SQL Server from managing them automatically.