That seemed like a web filtering issue. I'm looking at ways to go through machines that are behind in patching and figure out why. One method I've come up with is filter for machines with no patch scan scheduled. I know that they have policies associated, so I reprocess the policies on that view and they get their patch schedules back. They essentially forget their schedules and stop patching.
This makes me thing the Automatic Policy Deployment Interval / Compliance Check isn't as good as advertised.