Hi,
We were able to correlate the VPNs MOS degradation with a single Internet service provider at the spoke sides. Turns out a core router, between two Internet service providers, was dropping some packets (on the spokes side Provider A and the hubs side Provier B). The core router in trouble was common to both hubs but only in line with Provider A network. Our other sites that used other service providers were not impacted. So, mystery is solved.
Just too bad the MX offer limited ping test.