Profile/certificates cannot be removed after expiry

We loan out iPads, so individual schools often put their own WIfi settings on after the iPad gets to the school.
In the last couple of weeks, multiple schools have rung up because they haven't been able to remove old expired profiles/certificates (which say they are removeable). It's like these old certificates have become part of the MDM profile, even though they were added later and separately.
So far, the only solution we've found is to wipe the device, but it would be good to have another option.
Has this happened to anyone else?