OK, I exported the report and came up with only 5 computers that requested a full copy of the revocation list in the last 24 hours. That's only 5 out of about 1900 total computers. The vast majority only requested one download, but none made the request more than twice.
As for your questions, SEPM is set to check with LiveUpdate every 4 hours and I'm keeping 120 revisions. Also, the clients are set not to update from the internet, the LU policy is set so they only check with their GUP and SEPM.
I'm not sure if it is related, but our SIEM is getting the following syslog error message from the SEPM and it appears to be occuring on a large number of machines:
10 06 2015 13:11:03 [SEPM IP] <LOC6:ERRR> Oct 6 13:09:59 SymantecServer [SEPM HOSTNAME]: [CLIENT HOSTNAME],Category: 2,REP,Cannot assign a client authentication token. There was a general communication failure.
My understanding is this error is related to clients communicating with Symantec for insight updates as well, but I haven't been able to resolve it. Do you think this is related?