I"ll try to answer the remaining question bellow.
1. We noticed from SM log that the agent restarted, is that normal behavior?
I would want to validate that in the logs. Did the agent crash? or stop?
If unable to connect to a policy server and all requests have timed out, would fail to start or come to stop gracefully.
However, if it restarting, a crash condition might have occurred?
What's the release of the agent?
2. We have multiple instances, looks like one among them could not re-establish connection, once restart webserver instances it is all worked fine. Is there a chance some instance may not able to automatically reconnect after policy server issue resolved?
Again, this might be related to configuration of the policy server connections or it might be related to the agent configuration.
For instance, you need to have a unique value for "ServerPath" in the webagent.conf file.
Also, adding 'agentwaittime' = N (where N is a value of 30x number of Policy Server in the boot strap. + 10) to the webagent.conf file might assist in the agents timing out during boot strap under network latency.
If you have 6 servers defined in the SMHOST.conf file, then (6*30) +10 = 190. agentwaittime=190
Also, if you have the Policy Server listed as FQDN consider testing with IP addresses instead.
In summary, I would .. .
1. check the release notes for code issues within your release of the agent.
https://docops.ca.com/ca-single-sign-on/12-52-sp1/en/release-notes/cumulative-releases
2. remove DNS resolution from the equation by using IPs for the policy server connections by the agent in the SMHOST.conf files.
3. Confirm that the value for "ServerPath" is unique for each instance.
note: Serverpath does NOT need to be "Actual directory Path", you can use any unique value. For instance "ServerPath=MyAppName
4: Add "agentwaittime" to the webagent.conf.
https://docops.ca.com/ca-single-sign-on/12-52-sp1/en/configuring/web-agent-configuration/basic-agent-setup-and-policy-server-connections#BasicAgentSetupandPolicyServerConnections-AccommodateNetworkLatency
Does this help?
-James