When a system is deleted or purged from the ICDm console (Symantec Endpoint Security Complete, SESC) and returns to the cloud server, it ends up in either the Default group or the group targeted by the installer used to install the client.
This is working as designed.
When a client returns to the cloud console after being manually deleted, or purged due to not reporting for 30 days, it will return to the group specified in the installer used to install that client to the computer. If that group no longer exists, it will be placed into the Default client group.