Not sure if someone will beat me to answering, but I know exactly how that message is being created. I had to interpret what the user is doing, based on what I saw on the controller.
You're doing mac auth, so I assume you are using a Registration portal for the kids to register their device.... Either they are registering it AFTER clicking to connect, or within seconds of each other.
Long story short, they are getting into the "logon" role on my campus, due to not being registered. The logon role goes now where for us. The Roku thinks that there is something stopping it like a splash page.
I set a 5 minute re-auth timer on that role so all I'm relaying to our Help Desk is to have the kid get off the Network screen on the Roku, or shut off the TV for 5 minutes. At the 5 minutes, they age out of the controller, and when they try again, Clearpass accepts them as a registered user....
I plan on changing that re-auth timer to something higher in the semester, but for right now its been saving me from a lot of aaa delete's ....
If they STILL get that message, then they didn't register the mac address correctly still.