@bigfixforum, you’ll want to implement the “Last Fallback Relay” configuration via the BESAdmin utility as identified by @anademayo to hide the root BES server from all clients.
As far as finding what the BESClient is doing regarding relay affiliation, you’ll want to enable BESClient debug logging and then review the besclientdebug.log details.
One question, can you confirm that your LAN isn’t blocking ICMP traffic as automatic relay affiliation does rely on ICMP/ping/TTL data in conjunction with the Relays.dat file that’s distributed to all BESClients.