Some Configuration Profiles deploy; some don't

Hi Folks:
I've got a workflow that deploys five Config Profiles after enrolment (DEP or manually). It seems that pretty regularly - maybe always - four get deployed just fine and the fifth sits in the list as "failed".
Why would that be? It's obviously in scope or wouldn't be in the log at all. We're able to communicate with the APNS all right or the other four wouldn't deploy.
Any idea why this one doesn't go?
I can exclude it from scope and apply that then a few minutes later remove it from the exclusion list and apply that then it goes all right and works fine.
We can't achieve a "Zero Touch Deployment" like this.
Thanks for reading!
- Scott