Probably those 33 clients got their updates from the Liveupdate server (internet).
Check if "Liveupdate Server" is enabled in the liveupdate policy for those clients. If yes, this is normal. The clients got the new definition before the SEPM downloaded it.
If you don't want the clients to get the updates from Liveupdate server, disable this option in the liveupdate policy for the clients.