Wes,
Did you get this resolved? I see it's been a month since you posted this question.
I've seen this when ISE isn't properly profiling the device. If you go to Administration -> Identity Management -> Identities -> Endpoints, filter by the MAC address in question, then look at the endpoint profile. You can click on it to see the attributes ISE has collected to identify this endpoint. I'd also look at Live Authentications during the time this happened to see if the Endpoint Profile changed during the flow.
Tim