a few users are getting "are you sure you want to open "program" message a few times a day

Hi, can you be more specific about the message? Are you talking about the quarantine message that comes up when opening a downloaded application? If it is the quarantine message, you should be able to clear the flag on the affected applications via script or command from a policy.

I asked user to send me a picture. My co-worker said that it sounds like that downloaded application quarantine. What kind of script do I need to run?

Thanks

sudo xattr -d com.apple.quarantine /Applications/Appname.app

Try the above on one system as a test, but when you place it into a policy remove the sudo from it since that won't be needed.
If you get a response in Terminal of something like No such xattr: com apple.quarantine then its not the quarantine flag causing the problem. If it just returns the command prompt then it likely was that.

The odd thing is, as an admin level account, your users should have been able to get that flag removed by launching the app, but occasionally a permissions issue may prevent it from being removed.

defaults write com.apple.LaunchServices LSQuarantine -bool NO

any idea if this will work as a login script?

I don't know. Not too familiar with that defaults command, but it looks like it would turn quarantine checking OFF for the user account as a whole, which I don't advise. The quarantine check is there for a reason. To alert someone that the app they're launching for the first time was downloaded from the internet.
If you don't want your users seeing that message for any apps you deploy via Casper, you can easily remove the flag yourself before packaging it by simply launching the application once, entering your admin password to clear it, then quit and relaunch it one more time to confirm the message doesn't come up.. Then wrap it into a package and when its deployed the flag won't be present, so users won't see the message.
Or, you can use the above xattr command I mentioned on the target app to remove the flag, then wrap it.
I would not advise removing the OSes ability to check this at launch though.

I guess next time I update google firefox etc I will do that. I dont understand why only 2 users are getting this out of 20