What happens if you re-apply the policy / General tab (you may need to recreate the Policy and apply the NEW one):
Enable on-access scanning at system startup
Enable on-access scanning when the policy is enforced
First Question: Not really sure what happened there, sounds kinda strange. Wondering if you are dealing with a corrupt policy. In the system tree you can add OAS Enabled as a column to get a better idea of how many systems have been impacted by this.
As for the Second Question; 1) you could re-install VSE88P9 through the ePO console with the following command line REINSTALLMODE=amus /q or 2) create a SFX with the registry changes and EEDK it ePO Endpoint Deployment Kit 9.6.1 - Enterprise Edition
I don't use the ePO, so a corrupt policy can't cause the problem.