Clound enrolled hybrid Symantec Endpoint Protection Manager (SEPM) managed clients log in the client system logs events with description "New client policy received from cloud".
Release : 14.3 RU4
This is normal behavior as the client has a roaming feature where hybrid clients can communicate with the cloud directly when in an offline mode or no communication is possible to the on premise SEPMs. This allows the administrator to have some visibility into the offline clients until they communicate and synch with the SEPM and the bridge service uploads the clients data. The clients then switch in the cloud back to the appropriate on premise group from the cloud default group.