Some users receiving errors when attempting to login and they are asked immediately to wait for the next token code. 
Log Level: INFO
Action ID: 23021
Activity Key: Next tokencode mode activated for token
Description: Next tokencode mode activated for token serial number “0001418xxxxx” assigned to user “xxxxx” in security domain “SystemDomain” from “xxxx AD” identity source

Time on Primary and Replica is different.
Above log also has a field 
Instance Name: <primary> vs. <replica(s)>
look at authentication activity over a period of time, may see something like
5/18/2016  4:29:26 PM AUTHN_METHOD_SUCCESS <replica>
5/19/2016  7:32:07 AM Next tokencode mode activated for token <primary>
Where success followed immediately by NTC, so this is not a failure related NTC

Fix time, specifically time source on Primary and all replicas.

Run ./rsautil sync-tokens -I to clear NTC and lockouts, but this is only a patch. If the Primary and replica times are more than 2 minutes apart, this problem will keep happening whenever a user authenticates against one then the other.

See also KB 000027095 - Explanation of Next Token Code Mode and Small Medium and Large Windows in SecurID Authentication