Connection handle is 0xFFFF in attribute access callback when ble_gatts_notify() is called.

[SumeetSingh19]

Whenever the server application calls ble_gatts_notify there is a characteristic read event (access_cb) and the connection handle passed to that event is 0xFFFF.

The issue exists because ble_gatts_notify calls ble_gatts_notify_custom with txom set to NULL.
In ble_gattc_notify_custom, if txom is NULL, it fills the buffer with data from the same attribute whose handle is passed to ble_gatts_notify_custom.
The way it does that is by calling the access callback of that attribute through ble_att_svr_read_handle, and it specifies the connection handle as BLE_HS_CONN_HANDLE_NONE, which is 0xFFFF.

So server application gets an invalid connection handle when notifying a client.