I have been seeing a lot of this as well. No clue about cause or impact.
I'm also working on similar issue as this with jamf support. This also means that your client's MDM certificate based communication is not established properly. I have noticed this on only new enrolments or re-enrolments of os x clients (post JSS upgrade). They will not have MDM profile installed. Any existing enrolled clients will still have proper MDM in place.
Possible temporary fixes are:
1. Try enrolling those clients again using Recon app
2. run command on terminal ```
sudo jamf manage -verbose
3. Manually running jamf command to enrol client using ```
sudo jamf enroll -prompt -noRecon -noPolicy
you can check log on client at /var/log/jamf.log
Other things to check on JSS webapp are:
1. JSS>>Settings>>System Settings>>Global Management>>JSS URL and make sure you have FQDN as HTTPS URL.
2. JSS>>Settings>>System Settings>>Apache Tomcat- and make sure your certificates are in place - you can also consider replacing the Built in CA here by following Change SSL Certificate for HTTPS button. (Be careful here)
3. JSS>>Settings>>Global Management Framework>>Security and confirm that you have push notification enabled and settings are right.
Please take backup of your server before attempting to change anything on JSS.
I ended up manually re-enrolling all the iPads that were having the above issue. Luckily we don't have a whole lot of iPads yet. It worked. They now grab policies and use VPP codes correctly. It was a pain but it seemed to the trick.