In case anyone else runs into this:
We allow "Check Point Services" as a destination for our support admins. This morning, when attempting to access supportcenter.checkpoint.com, I could not. Checking the logs, I found that the destination 126.96.36.199 was being dropped by our geo-blocking policy. We block Israel, among many other countries, in our geo-blocking policy after the rule which allows "Check Point Services". The IP does not resolve to a domain name, but is owned by Check Point.
Not sure how we are going to handle this. Best case scenario is that Check Point updates the updatable object "Check Point Services" to include this IP. I don't really want to open "Israel" for all clients.