Ok,
Thanks for the input, we have the same setting in our system.. This would indicate that for indeed for CJ20N no check is executed when it calls CJI3. However there are also some SAP notes indicating that the SE97/TCDCOUPLES is not always behaves as described
You could do an authorization trace (via ST01) on a user who has the issues (so the issue that the user cannot start CJ20N when that same user does not have access to CJI3). If indeed the CJI3 is called via CJ20N you would see a 'failed' check on S_TCODE=CJI3. If this shows up in the trace then this is still an indication that CJI3 is checked when called from CJ20N. If then this same situation can be replicated to a sandbox/dev environment, then you check explicitly set the flag in SE97 to 'Not Check/Information' for the CJI3, called from the CJ20N. And then check the same error still occurs.in that system (also verified by an authorization trace).
If no S_TCODE check for CJI3 pops up, or the changing of the SE97 setting for CJ20N -> CJI3 has no effect, then the cause of the issue is at least not caused by the 'call transaction' mechanism.