In the Notification mails there is a tracking pixel which becomes visable in ticket systems like TOPdesk. These links look like this: http://xrvm4.mjt.lu/oo/AVMAAGJexg8....
Some users see this and think this is some kind of phishing link. the link also doesn't use a secure connection. Maybe this can be aliased with email.helloid.com, but preferably this is hidden in TOPdesk and sorts.