pfsense can not prevent ARP spoofing originating from users on the lan network ??? how it can if ?????
No os in this planet can protect from that by design.
There are tools that can be installed on pfSense for this as well.
I think one of them is a package.