"Generated token is too large" on some user profiles, but not others

The audience option in Lock: Lock Configuration Options

The oidcConformant options in Lock (also check the linked cross-origin one in that section): Lock Configuration Options