zscaler and some VPNs mess up ssl certs and bazel will fail fetching. Similar deal if you have your own repo with self-signed certs, I reckon.
So, as you run into errors, note the server bazel is trying to download from e.g., here it's mirror.bazel.build
ERROR: /private/var/tmp/_bazel_jwattenbarger/a2f146ad396f505902e2eb9d5d7b725a/external/bazel_tools/tools/test/BUILD:36:6: @bazel_tools//tools/test:coverage_report_generator depends on @remote_coverage_tools//:coverage_report_generator in repository @remote_coverage_tools which failed to fetch. no such package '@remote_coverage_tools//': java.io.IOException: Error downloading [https://mirror.bazel.build/bazel_coverage_output_generator/releases/coverage_output_generator-v2.5.zip] to /private/var/tmp/_bazel_jwattenbarger/a2f146ad396f505902e2eb9d5d7b725a/external/remote_coverage_tools/temp8333830970334961723/coverage_output_generator-v2.5.zip: PKIX path building failed: sun.sec