I've seen this a little while ago where servers in the same cluster did not have the same Baseline/Baseline group in update manager.
It appears to come from enabling or disabling certain services like SSh. So if you had enabled or disabled on some hosts but not others it can seem to get the ruleset. I have also see sometimes you have to refresh the gui and it will disappear from the firewall section. I ran into this months back and your solution by disabling the ruleset check i think is the easiest way.