Greetings,
As far as my understanding is. Filevault2 works on Secure tokens and aswell Boostrap tokens. Those have specific criteria on how they are obtained. With Jamf 10.26.1 Boostrap tokens auto-assigned were introduced to devices enrolled via DEP with creating a local account within the setup assistant.
With BigSur this is even a bigger thing for tokens to properly be obtained. Some information from JNUC 2021 is explained on this video and I hope it helps. https://www.youtube.com/watch?v=wgWsIW9E4V4
Note: As well in prestage checking off the box Prevent the user from enabling Activation Lock would help on providing the bootstrap token to the user via DEP. There was a bug on Jamf's end and this was their workaround.
My question would have been. If upgrading users from Mojave to Catalina and they do not receive the bootstrap token or do not have a proper secure token how is that being handled then. Apologies if this does not answer your question directly but maybe puts you on a path to it. Also, suggest opening a support ticket with Jamf.
Best,