Long story short, I was having an issue with machines that were reported with scan failures. As I've been going through the list, I've got an increasing number of machines with duplicate IP addresses. The serial number and GUID are unique but, they're not checking in I believe* because of that duplicated IP address.
The thing is, we image all our machines on two VLANS. They get their own version of SEP installed (not from the image) and we verify they check into the SEPM and get their defs before rolling them out. It's not all of our machines though, which is weird. Is it possibly an issue with the version 12.1.4 that's installed on these clients? I've been upgrading our machines to 12.1.6.1 and as these aren't checking in, they're not getting that update either.