1) Firstly Control your DHCP User Class Properties ; Be sure you have correctly configured your scope options.
Under Static Route Option you should type the releaated host ip address twice or if host is one other subnet type gateway and host ip address.
2) Under User Class Check if your DHCP lease time is not too long.
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007378141105298
3) Check the solution in the links below;
http://www.symantec.com/connect/forums/snac-dhcpplugin-always-get-quarantined-ip-address
http://service1.symantec.com/SUPPORT/ent-security.nsf/ppfdocs/2008020608273348?Open&dtype=corp&src=&seg=&om=1&om_out=prod
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007091212133148
4) Lastly , as my experience DHCP Server and SEPM should be installed on different servers.
Read more...