Okay, so HERE is why it would (and did) happen.
I have typoed IP addresses in the 3rd octet on a couple of my vKernel interfaces.
Check yours - they must have a typo in them.... right? (seriously, go look... C A R E F U L L Y)
================================================================================
I have two separate iSCSI vKernel interfaces, each bound to two seperate vSwitches, and each vSwitch with 1 physical NIC.
( I do this for multi-pathing (I use Round Robin with an i/o value of 1 request per channel before changing to enhance speed)
Anyway, I also have multiple vSAN vKernel adapters as well for the same reason.
ALL these adapters have separate subnets.
I got the 3rd octet wrong when I typed in the IP on one host in two seperate clusters.
One IP was an iSCSI interface
The other was a vSAN interface.
This is why the hosts compliance would flip from one host in compliance and the others out, or all the others IN compliance, and this ONE being out.
This same type of error being in two separate clusters, on two different types of vKernel interfaces mad it nearly IMPOSSIBLE to spot.
All the flipping made it hard to diagnose, because it all looked related.
Once I corrected the issues, and updated my profile from the reference host (yes you need to do this), then everything passed compliance.