Three things can cause a machine LeafNodeID change:
1. The system was deleted from the database and a new LeafNode created. This can occur either from a manual delete or via a server task such as Duplicate GUID cleanup task. Check the ePO Audit log to verify if the system was deleted.
2. The system is affected by the issue outlined in KB52949. If you have not applied the solution in this KB, identify the vendor ID of all VPN appliances and enter them into the ePOVirtualMacVender table in the database.
3. The ePO database was reverted to a backup to a time before the system was added.