macos 15.1 just started installing on our Sonoma Intel macs

it happens sometime if we have two different deferrals configured 

The software update deferral mechanism isn't 100% reliable. As @Shyamsundar mentions having multiple deferral profiles in place will create a problem, but even if you only have one deferral profile you'll still see some Macs manage to update. Use the Feedback Assistant to file feedback with Apple that if they're only going to provide one option for deferring updates they need to make it a more reliable option.

Yes, had a few Intel Macs upgraded. We have only 1 deferral in place (fixed this with the Ventura upgrades). I have the restrictions to block the macOS Sonoma installer as well.

No rhyme or reason why these upgraded. Happens every year.

We put in an Apple ticket and they found a problem, but they are not going to fix it. Just FYI.

Wrong thread...

Last year, as I was deferring macOS Sonoma, we found out two issues. The first is that Apple's software updates don't always advertise themselves as either a major upgrade or a minor update. Because of this, the profile can't defer them. The second issue I found out from AppleCare Enterprise was that the way that Jamf Pro manages the settings using MCX is actually old. It works most of the time but it needs to be updated. I am seeing a few systems that I did not authorize to upgrade. Some of them were upgraded before they were enrolled. I can tell this by reading the install logs on those Macs. I see the Jamf Pro enrollment happening after the upgrade to Sequoia. These were on user-initiated enrollments. It was the same thing last year. Most of our Macs enroll through PreStage. Only a very tiny number of my Macs have been able to upgrade. I'm not going to worry myself too much over that small number. Out of just over 1400 Macs, only 30 are running Sequoia. One of those is my own MacBook Pro.