What version of WSO/AirWatch are you on and are you up to date with the Seed scripts? I saw this in our environment (19.03) when the iOS beta 13.2.3 came out and device were forced un-enrolled and could not enroll as they were not considered on a valid OS version.
Make sure you are on the latest Seed script if you are using enrollment restrictions.