I'm wondering if there's unique with the SPA9xx phones' configuration. Are the SPA9xx phones perhaps listening to the multicast group that the SPA5xx phones join in on when they boot?
Consider trying the following:
1. Enable debug level 3 on the SPA9xx phones
2. Run Wireshark on the SPA9xx subnet (with no filters)
3. Connect a SPA5xx phone
4. Review the Wireshark trace to determine what the SPA9xx is receiving to cause it to unregister
5. It would also be interesting to understand why the SPA9xx phones go into a boot loop
You don't mention the firmware version for the SPA9xx phones, make sure it's the latest available from Cisco.com
Could the issue be related to the PoE switch? The SPA5xx phones support CDP and LLDP which the SPA9xx phones don't. Try disable CDP/LLDP on the switch, if enabled, to isolate the root cause.
Use this reference document to locate SPA phone resources