andy33 The server record in the "Out-of-date connecting servers. . ." report should show the detected build date as the build that was out-of-date before you updated to .037. However, the Status for that record should say "Up to date" and the Details should reference when you updated to a compliant build (e.g. 15.01.2507.037). If it's not, DM me your tenantID. If you're concluding this based on the cmdlet output, then that's by design to show only historically or currently out-of-date build records. You won't see a compliant build record from the cmdlet at this time as it was designed primarily to support historical server records for the report itself.
There is an edge case / bug where Exchange on-prem will stamp the wrong build number onto messages that could be impacting this (those sent via Pickup folder or SMTPServer.SubmitMessage API call). Regular messages (those NOT sent via Pickup folder or the API call) would appear with the correct compliant build .037 and aren't subject to enforcement. DM me your tenant ID and I can check on our side.
Best wishes,
Kevin