I've recently came up with an issue where some users on a contact list would show up as stuck on "Updating..." and others would show the presence fine. It was a pool with 3x FEs and it was easy to pinpoint it was something probably related to one of the FEs.
Looking at the Event Viewer I found several errors from "LS User Services" Event ID 32042 and 30988. Event ID 32042 was complaining about not trusting the other FEs certificate, which was very odd has nothing had changed in a long time.
I had a look at the problematic FE Certificates store and found a non self-signed certificate in the Trusted Root Certification Authorities which is a problem for the Windows Server 2012 OS as per following article.
All I had to do was to remove that certificate from the container, reboot the server and things went back to normal.
From what I can gather the certificate had been in that store for quite a while but the issue only manifested itself after the server rebooted.
Now all I have to do is to find whoever stuck the certificate in that store... and beat him with a stick :)