Resolved! Cisco ISE GuestEndpoints
When users accept the T&C's page for our guest wireless I have it configured to add them to the GuestEndpoints group. How long does ISE keep that account active? I looked at the purge settings for guest accounts but it doesn't appear to purge these...