Secure Score misreporting Windows Firewall status

We have ~500 endpoints all managed with the same Windows Firewall GPO but only about 50% of these are showing as compliant in Secure Score/TVM.

Firewall is enforced on for all profiles with default deny inbound and rule merging disabled. This is 100% policy-managed across the whole estate.

The firewall is definitely active on these computers.