I had a user that needed to have their system blown away and rebuilt. After my colleague nuked it and removed the record in the JSS it was having real trouble enrolling and grabbing apps. I verified that it was removed and wiped properly several different times and still was not seeing expected behavior, namely Self Service wasn't populating apps and policies.
The logs initially showed that there was a "Device Sig error," so I ran the enrollment from the command line and was able to get these to show up. Standard polices started working, sort of.
Example: Filevault was running, but the part that kicked off the reboot simply didn't happen, so we had to manually reboot it (which finalized the policy properly)
Fast forward: Now we're seeing VPP content acting as if the app isn't properly registered. See screenshot. No one else in the org is seeing this...