Might be a SafetyNet Attestation failure. Do you have that option configured to enroll on Attestation failure in your enrollment rule?