Users blocked - To Many Failed Login Attempts - on first attempt

Several of my regular users have reported they are blocked from logging in with the error Too Many Failed Attempts even though they have only tried to log in once. I thought they were being foolish but tried myself and found that, even though I log in to the front end successfully on a regular basis, I too was blocked on my first attempt using my saved password.

I checked CBantispam, it was set up normally to block after 5 failed attempts within one month. I changed the settings to 8 attempts within one day but more users reported the same results. I turned auto-block off and can now log in normally.

I am using the latest version of CBantispam and Joomla 3.9.4. My site is vibrations.ca, I gave Kyle a log in a few weeks ago for another issue but can re-send it if necessary.

Any ideas you may have will be appreciated.

Review the attempts log within CB AntiSpam > Attempts. The attempts will clear for their ip address on a successful login. Have retested this usage and confirmed it works perfectly fine. For example type your username, but input an incorrect password. You should see an attempt entry logged. Next login successfully and that attempt entry should be gone.

Thank you Kyle - I tried that and it worked as you said it would but I saw something that looks weird to me, maybe you can explain it.
Under my one failed attempt there was another using the same IP (the dedicated IP my hosting service uses for my site), it showed 67 failed attempts to register just four hours earlier and, at the same time, 8 attempts caught by the captcha. I didn't do any of that, I only tried to log on once.
I also noticed there were no more than one or two failed attempts from any IP address (except for one, which was not a login) so why are so many users having trouble logging in?

it showed 67 failed attempts to register just four hours earlier and, at the same time, 8 attempts caught by the captcha. I didn't do any of that, I only tried to log on once.

Only reason for that is if the $_SERVER values were changed. Specifically REMOTE_ADDR or HTTP_X_FORWARDED_FOR. Seams like maybe your host or something installed could be altering the global $_SERVER values, which would cause something like what you're seeing.

I also noticed there were no more than one or two failed attempts from any IP address (except for one, which was not a login) so why are so many users having trouble logging in?

I've no idea. It's entirely IP Address based and whatever ip address they're using to login has failed to do so several times. Try emptying the attempts log and see if you've any further issues.

Thanks again Kyle - I have cleared the list and I did notice today that one user who was having trouble was able to log on yesterday. I must admit that your answer to my first question is beyond my limited knowledge (i.e. I didn't understand a word) but it looks like something I can't do anything about.
FYI I also checked the Blocked list and saw that the latest one was over 9 months ago, but I've had at least 6 emails from users who were blocked in the last month or so.
Could the fact that I'm still using PHP 5.6.40 be causing problems? I've tried switching to 7.1 but it crashes one of my older sites, presumably because there is something in there that conflicts and I haven't had a chance to find it yet.

Your PHP version shouldn't particularly matter. I'd just keep an eye on it and if it happens again check the logs to see how many attempts they have. It's possible they're using a proxy and that proxy host is being used by a couple people, but that shouldn't be an issue if they complete a successful login as it will clear the attempts.