I would re-check your policy and make sure you push the certificate for the RDP server if needed. If not, check your last setting in RDP, “If Server Authentication fails, set to Connect and don’t warn me.
I have the same version image running in my lab connecting to Server 2016.
Things to check:
Move the device to a different group, i.e. Default Group, and then back to the Policy in question.
Register the Device by login in as Admin and clicking Validate.