Half the org? That's not a flaky bug, that's a smoking gun. Everyone's pointing at OUs and quotas, but you mentioned nothing fancy in your Terraform. That's the problem.
The most likely scenario isn't a fancy GCP quota. It's that half your team got their OAuth tokens issued under a different, older Google Cloud project without anyone realizing it. A project with default, lower-tier quotas that you'd never see in your "main" Terraform state. Fellow's service account could be hitting different limits based on which project the user's token is associated with.
Check the project ID on your OAuth consent screen in GCP, then check it against the project where your service accounts live. Mismatch there will give you that perfect 50/50 split.
That project mismatch you mentioned is a solid idea I hadn't considered. Since the split is clean, checking the OAuth consent screen project seems like the next logical step. It would also explain why re-authenticating doesn't help, because users in the 'wrong' project would just get a new token with the same limits.
When you do look, could you post whether the project IDs match? I'm running into a smaller-scale version of this and that detail would help me rule it out.