I also have a lot of issues similar to this starting at 2016 SU3. Previously it was working fine but with SU3 I could no longer provision devices because the public variables using passwords could not be decrypted (at least that is what it looks like to me). This broke Windows and Mac provisioning and in all instances the logs point to a bad password but I know the password is correct. I currently have a ticket open with support.
I also have a ticket open. As a workaround I replaced the boot.wim with the backed up version (Boot.wim.BAK) on X:\Program Files\LANDesk\ManagementSuite\ldmain\landesk\vboot previous to the upgrade and redeployed the PXE reps and that seems to be working for me.