If it's a named instance, then by default it does dynamic port allocation. When SQL Server starts up, if something is listening on that port, it'll choose a different one. Since SPNs are configured per port, this is bad. It means your SPN is invalid and Kerberos authentication doesn't happen. Check to see if that's the case. If it is, find out what port it was using by listing the SPN. Then statically configure the port to what your SPN has registered.
K. Brian Kelley
@kbriankelley