Troubleshooting: Login PA firewall and check MONITOR>URL Filtering. We find block-url policy blocks www.evernote.com because of medium-risk.
This is the definition of medium-risk Palo Alto networks.
If the user really needs it, he can download it from his home computer or WiFi without PA firewall.