It's been a while since I had the misfortune of dealing with Cisco. However, did you remove the KEXT from their config profile as those are deprecated. Also is the device supervised or just managed?

You should not be using Kernel extensions. Cisco moved away from those around macOS 11 timeframe.

I removed them from my environment, maybe four years ago.

You should be using system extensions instead, the screenshots should help.

Knowing Cisco, the configuration profile they provide still has the KEXT in it. I know it did 2 years ago when we dumped AnyConnect which was a year after Apple retired KEXTs, I had to manually add the system extension stuff as Cisco's support had no idea how to do it. Their documentation was really emberrising for a company their size.

We also created  new profile for management notifications. Bundle ID: com.cisco.secureclient.gui as Cisco update in I believe 5.1.3. to "secureclient"  

Thanks ya'll. I have been using this guide, I am thinking it is now outdated?

https://hcsonline.com/support/white-papers/how-to-deploy-cisco-anyconnect-with-jamf-pro

It is but I essentially used the same setup for 5.1.3 and have deployed to almost 300 users and so far, so good. Install script 

Our devices are all Supervised and running 14.4 or greater. All Silicon

I have a separate Config with the Managed login items

Removing the KEXT fixed the issue on the device in question. Still not clear why it installed on my device with no issues.

So, removing worked for my test device, but does not explain why my device had no issues with the config profile. We are both macOS 15.1, mine M3 MBP, the other M2 MBA