Well we're now thinking that it's either:
the mfehidk.sys driver
or the mfevtp service that's causing this.
1) PC with VSE 8.5 installed with the sysprep works fine
2) PC with VSE 8.7 installed with sysprep fails to even get to join the domain
3) Same PC in #2, but remove VSE, and re-sysprep it and it works fine
I tried disabling the McAfee services, and the ONLY one I couldn't disable was the MFEVTP (error 5, access is denied). (you cannot stop/disable this in the services.msc no matter what you do in the VirusScan Console or even if AP is disabled).