not sure this relates to your problem, but we had a similar problem with Distributed repositories, and the cause for them to become enabled was that the names contained non-standard characters (i.e. characters from a non-English alphabet.)
After substituting the offending characters, then making clients reload the policy and sitelist, the repositories remained disabled (as in the policy).
You could check if this is your situation by looking at the name of the repositories in the ePO policy and the name of the repositories on one of the problem clients: on clients chances are the offending characters are omitted from repo names.
Message was edited by: Attila Polinger on 05/01/11 13:26:10 CET