Yeah that makes sense now.
I was looking at some authentication requests from Friday that were a little messed up because we had some problems with our CPPM on Friday.
So for all the client requests they were missing the '[Machine Authenticated]' role .
I just had a new client connect where both the computer and user authenticated.
And in the client request it contained the two roles [Machine Authenticated], and [User Authenticated]
which now makes everything make sense.
I apologize for my confusion!