From 1607 and 1703.
I think I figured out what was going on.
In Setupact.log I saw this line: "Client OS edition and OEM license detected and no enterprise edition detected, will not run SetupComplete.cmd"
So the SetupComplete.cmd script didn't run which caused the TS to stop and the CM client to remain in Provisioning Mode.
Due to the specific nature of the client they have devices with OEM licenses as well.
This is because many employees work in remote locations (Africa, South America, Asia, etc...) and they purchase devices locally with OEM licenses. Those are then joined to the domain CM Client is installed manually and devices is encrypted with Symantec Endpoint Encryption.
I did test on random devices where some of them were indeed activated with OEM license and others via KMS. Those activated via KMS worked just fine.
Is there any way to change the Setup.exe command line string that's executed by the TS?
I do append extra switches, like /ReflectDrivers, but can you actually change the default switches?