It doesn't actually timeout after 40 attempts. It will still launch after that if everything is set up correctly. The number 1 thing I see with provisioning simply not starting is that somewhere a provisioning task is still listed as running, ie a provisioning action never received an exit code for an action, and never requested the next action, so the client times out but the core still has it listed as Active.
If that's the case you should be able to find out really easily by leaving the device in WinPE, finding it in the console and adding it to a task. If it goes immediately to failed then you should check the Message column for that device (towards the right) of the task detail and it will tell you that it is already running a provisioning task, and even tell you the task ID number for it. You can test this with a simple template that only has a wait action and nothing else (or any other simple template you want to create for testing).
If the task starts when run from the core we'll probably want to start collecting some logs, but let's start with this.
Let me know if that helps you find anything.
Yes, the job still builds on the core, but on the machine it will return back to the provisioning menu after it times out. if we wait a few minutes to let the job finish building on the core, and reboot into PE, it will then just pick up the job and run fine.