When the Quota operator gets back all resources with quotas for timer based reconciliation, it does not currently properly convert them from the TLS format into the CR format (in case the user is a TLS user, it needs to be converted from CN=username to username). This is causing issues because it triggers reconciliations for wrong users which might delete the correct ACLs by mistake. It does not show up every-time since the timer runs also the proper reconciliation - so sometimes it cause issues and sometimes not. This problem was discussed in #5689.