atd.service should be ordered after nss-user-lookup.target to ensure
user names can be looked up via NSS. This was recently fixed in cron,
see for example https://bugs.debian.org/801384, and atd should have
the same problems.
It might also be useful to set KillMode=process to avoid running user
jobs getting killed when restarting atd.
So I suggest these additions to atd.service:
| After=remote-fs.target nss-user-lookup.target