I dropped the db user, 'maxscale'@'%' and created the following db users with appropriate rights granted respectively:

node 1
-------
'maxscale'@'ekycdb1'

node 2
-------
'maxscale'@'ekycdb2'

node 3
-------
'maxscale'@'ekycdb3'

Final user table was as follows:
MariaDB [mysql]> select user,host,password from user;
---------------------------------------------------------------

---------------------------------------------------------------

---------------------------------------------------------------
11 rows in set (0.001 sec)

I stopped/started maxscale on all the nodes again. No more 'access denial' messages on mariadb.err. Maxscale status was correct on all the nodes.

=========
Node 1/2/3
=========
> maxctrl list servers;
┌─────────┬───────────┬───────┬─────────────┬─────────────────────────┬──────┬────────────────┐
│ Server │ Address │ Port │ Connections │ State │ GTID │ Monitor │
├─────────┼───────────┼───────┼─────────────┼─────────────────────────┼──────┼────────────────┤
│ server1 │ 10.0.2.14 │ 33063 │ 0 │ Master, Synced, Running │ │ Galera-Monitor │
├─────────┼───────────┼───────┼─────────────┼─────────────────────────┼──────┼────────────────┤
│ server2 │ 10.0.2.15 │ 33063 │ 0 │ Slave, Synced, Running │ │ Galera-Monitor │
├─────────┼───────────┼───────┼─────────────┼─────────────────────────┼──────┼────────────────┤
│ server3 │ 10.0.2.16 │ 33063 │ 0 │ Slave, Synced, Running │ │ Galera-Monitor │
└─────────┴───────────┴───────┴─────────────┴─────────────────────────┴──────┴────────────────┘
> maxctrl list services;
┌────────────────────┬────────────────┬─────────────┬───────────────────┬───────────────────────────┐
│ Service │ Router │ Connections │ Total Connections │ Targets │
├────────────────────┼────────────────┼─────────────┼───────────────────┼───────────────────────────┤
│ Read-Write-Service │ readwritesplit │ 0 │ 0 │ server1, server2, server3 │
└────────────────────┴────────────────┴─────────────┴───────────────────┴───────────────────────────┘
> maxctrl list listeners Read-Write-Service
┌─────────────────────┬──────┬─────────┬─────────┬────────────────────┐
│ Name │ Port │ Host │ State │ Service │
├─────────────────────┼──────┼─────────┼─────────┼────────────────────┤
│ Read-Write-Listener │ 4006 │ 0.0.0.0 │ Running │ Read-Write-Service │
└─────────────────────┴──────┴─────────┴─────────┴────────────────────┘

If 'user'@'%' (either user=maxscale or user=monitor) is no longer correct, may you update the documentation on web and maxscale.cnf ? Or if there is bug, may you help to fix so 'user'@'%' alone will work again?

Ah, I think I figured out why it fails. I didn't see that you had an anonymous user for the ekycdb1 host:

Since connections from this host will match the anonymous user first before matching the wildcard user, it ended up causing authentication failures from that host. For whatever reason, all hosts had an anonymous user for that host instead of their local hosts. Once you drop that ''@'ekycdb1' user from all nodes, you should be able to use a wildcard user again. Normally you don't have anonymous users in production environments as they are dropped by the mysql_secure_installation command.

I have dropped all the invalid users and added back 'mascale'@'%' and 'monitor'@'%' with appropriate rights granted.

Here below is the final status:

MariaDB [mysql]> select user,host,password from user;
---------------------------------------------------------------

---------------------------------------------------------------

---------------------------------------------------------------
6 rows in set (0.002 sec)

I tried restarting maxscale again. All things went smoothly.

node 1/2/3
------------
> maxctrl list servers;
┌─────────┬───────────┬───────┬─────────────┬─────────────────────────┬──────┬────────────────┐
│ Server │ Address │ Port │ Connections │ State │ GTID │ Monitor │
├─────────┼───────────┼───────┼─────────────┼─────────────────────────┼──────┼────────────────┤
│ server1 │ 10.0.2.14 │ 33063 │ 0 │ Master, Synced, Running │ │ Galera-Monitor │
├─────────┼───────────┼───────┼─────────────┼─────────────────────────┼──────┼────────────────┤
│ server2 │ 10.0.2.15 │ 33063 │ 0 │ Slave, Synced, Running │ │ Galera-Monitor │
├─────────┼───────────┼───────┼─────────────┼─────────────────────────┼──────┼────────────────┤
│ server3 │ 10.0.2.16 │ 33063 │ 0 │ Slave, Synced, Running │ │ Galera-Monitor │
└─────────┴───────────┴───────┴─────────────┴─────────────────────────┴──────┴────────────────┘
> maxctrl list services;
┌────────────────────┬────────────────┬─────────────┬───────────────────┬───────────────────────────┐
│ Service │ Router │ Connections │ Total Connections │ Targets │
├────────────────────┼────────────────┼─────────────┼───────────────────┼───────────────────────────┤
│ Read-Write-Service │ readwritesplit │ 0 │ 0 │ server1, server2, server3 │
└────────────────────┴────────────────┴─────────────┴───────────────────┴───────────────────────────┘
> maxctrl list listeners Read-Write-Service
┌─────────────────────┬──────┬─────────┬─────────┬────────────────────┐
│ Name │ Port │ Host │ State │ Service │
├─────────────────────┼──────┼─────────┼─────────┼────────────────────┤
│ Read-Write-Listener │ 4006 │ 0.0.0.0 │ Running │ Read-Write-Service │
└─────────────────────┴──────┴─────────┴─────────┴────────────────────┘

No error messages displayed on mariadb.err.

It depends on you whether it is better to document this on maxscale.cnf or other documentation relating to maxscale. Please close this case. Thank you.