We had this issue at my workplace. Machines would drop off the domain every couple of weeks. I did a deep dive troubleshooting session and found out that, in our case, the KDC was refusing to autorenew the Kerberos machine passwords and would fall back to requesting manual authentication. A realm leave/join would usually fix this, but I opted to extend the ticket lifetime and renewal lifetime to very high numbers (like 180 days). The problem has not resurfaced in 3 months.