OTP FAIL EVERY 30 DAYS

Check the NTP Service on the XG. If the XG is not sync with NTP, the time gets out of sync and will invalid the OTP tokens. 

It is configured against an NTP server for both the XG and the computers, on some computers they had a 1 minute lag with respect to the XG, but there are many other computers that fail and have the same hour, minute, second as the XG.

The XG OTP has been configured with 30 seconds

Seems like the OTP Delay is not sync up in your case. I do not have experiences with browser Addons, as i use OTP only on mobile phones. 2FA on the same device makes the 2FA kinda useless, as exploiting the device, you are using, giving you both access (password + the current valid OTP token). Therefore best practice is to use a other device for 2FA, not the same. Its like having a key chain with two keys, needed to open a door, if both keys are on the same keychain, loosing this keychain will give you access and the second key is irrelevant. 

I know that it is not very safe to have the 2fA in the team but the client has wanted it that way even explaining it ...

Give him the example of Sophos Intercept X for Mobile. Free tool even for privat devices and explain him, this tool is way more efficient compared to a browser based solution. 

I connected to a computer that had the fault right now and I saw that it was 15 seconds ahead of the XG time.

The otp I have it set to 30 seconds.

I understand that 30 seconds are as much if a team is 30 seconds behind or ahead of the XG, right?

I connected to a computer that had the fault right now and I saw that it was 15 seconds ahead of the XG time.

The otp I have it set to 30 seconds.

I understand that 30 seconds are as much if a team is 30 seconds behind or ahead of the XG, right?