Unmanaged detector - false positive

I have several unmanaged dectors in my network (one per subnet).  I'm having one unmanaged detector w/ XP SP2 MR4 MP2 giving me two IP addresses that I know SEP is already installed on those two machines (XP SP2) with all features enabled and with green dots on the SEPM with the latest policies.  Both computers also have the latest definitions and are in computer mode and managed by a SEPM in the same subnet.  This subnet has about 70 computers, but only these two are reported as not having SEP installed.  The MAC addresses for both computers are different from what the unmanaged dectector sees versus what's in SEPM.

What exactly is the unmanaged detector looking for?

Also, once the unmanaged detector finds an IP, how long is that IP stored and reported on and what setting would help to purge the length of time that IP gets reported?  For example, several IP's accross different subnets have been reported for months now, but there is no physical device on those subnets matching the IP address (verified by physically looking at everthing plugged into the main switches and verifying their IP address manually).