Since Masked SYSID is broken, you can either default to the sysid of the LPAR by not specifying any sysid, or apply test fix that will correct the error.(SO01634 - Allow masking of SYSID for Factor Records.)
Verify you are observing the following in AZF#IN00 started task joblog:
.. AZF2109I Authenticator initialized : entry 0xA1690A0, name AZFRADP1 (strong) ..
... ( the 0xA1690A0 part might be different at your site)
If the Profile records are new, do F ACF2,REBUILD(USR),C(P)
And for the factor records: ........ F ACF2,REFRESH(FAC),T(FAC)
Also, make sure the Logonid/s is/are not in the MFABYPASS rule.
Deleting records with SYSID(*****) should resolve the problem. If both, lpar specific and **** are present, delete the **** record.