Just as an update:
I've managed to catch the error again on my machine by forcing the cache to update
much more often. I've compared the group entry in the cache both before and after the
corruption occurs and have found some interesting differences:
the entryUSN is different, not sure if that matters,
the isPosix flag is set to FALSE on the corrupted entry
the gidNumber is set to 0,
All the users and ghost members, SID number uniqueID are all the same. I managed to pull
an "AD group type flag set" 0x80000004 if that means anything at all to you.
Will update with more info as I see more.
Thanks,
Jamal