CEM enabled agents are only attempting to connect to SMP/Notification Server directly and failing. In agent logs we see no attempts to connect through the internet gateway.
All attempts to connect directly to the NS/SMP fail with "No such host is known"
Agent is starting, CEM mode is 'Enabled', registration status is 'Not registered'
Request 'HTTPS://<SMP.FQDN>:443/altiris/NS/Agent/ConnectionTest.asp' failed, COM error: No such host is known (0x80072AF9)
It was discovered that the CEM policy configured in the console had the internal name of the Internet Gateway and not the external FQDN or IP.
Once we added the external resolvable FQDN or IP address to the gateway policy (with the correct thumbprint), then re-generated the CEM agent installation package and installed, the issue was resolved.