I've seen this occur and I think it may be something to do with pending MDM commands as the only ways I've been able to resolve are to either purge all pending/failed commands by searching for just that device and doing so as an action, or my re-enrolling the device. This last part I had to initiate from the endpoint but that was before the mdm heal action through the API, so that might be worth a try.
