Servers are not running the upgrade for the SEP Client despite having the option "Allow Client Upgrade" selected in the assigned System Policy.
This issue is under investigation, but it appears that the default schedule options get stale.
To work around this issue, click to expand the Client Upgrade Settings "Show Advanced". Make any change to the schedule, such as adjusting the time window, or distributing the upgrade over X amount of days. Save the changes.
This should resolve the issue if it is caused by the issue detailed in this article. If this does not cause the systems to upgrade, a reboot may be pending. Try rebooting a server to see if the upgrade then commences.