An update to the situation:
We have found that removing XP SP3 allows the Real time scanning to initialize and show enabled. Once that happens, you can re-apply XP SP3 and all is well.
This is with the LD 9 SP3 client including AV.
This does not happen on every machine and we have found no smoking gun to tell us what causes this to happen.
I have talked to support about this and we weren't able to determine anything as of yet. We had already manually repaired all of the failed clients as described above. Once we get another that exhibits the problem, we will contact support again and let them have a look at the problem as it occurs.
More to come....