When a host accesses unattended controller to retrieve a provisioning template or signal built state, the host is resolved by a token. This token usually has a lifetime. If the lifetime is exceeded, unattended controller falls back to using the hosts mac or ip to resolve the host.

For the unattended/provision call, the host can be retrieved by it's mac address.
For the unattended/built call, the host is resolved the request IP. If the request is proxied through a smart proxy, the smart proxy ip is used to resolve the host. The smart proxy host is not in built mode and the host is in a built loop.

To make matters worst: This causes puppet certificates to pile up and the host cannot be deleted because foreman's call to deactivate the puppet certificate times out.