Did you check the last connection time and last status update time of problematic device to confirm that they are still under MDM control? If the above time-stamps show very outdated time, your device agent might have already been uninstalled, or the device might have been factory reset, etc.

Did you check the device log to see if problematic device has ever switched to "administrator mode" multiple times every day?  If so, maybe you can solve the problem just by frequently changing the device administrator password defined in the "authentication" payload.

Finally, for your question regarding guest account, you can disable future addition of guest account by including "Disable multi-user control" in feature control payload.

However, for problematic devices with guest accounts already created, you have to use remote-control or other means to remove the guest accounts.

I don't have any Samsung Tab E to look into the hardware and the GUI to check for any potential problems/loopholes. As there is no details on your use case, nor logs on the your problematic device and on your servers,  there is insufficient information to tell what loophole(s) caused your problem.  Once the cause is known, there is usually fix that can cover that to make your kiosk menu safe.