Why would Puppet revoke a client's certificate?

We started getting an error from one of the Puppet-agents:

Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read finished A: sslv3 alert certificate revoked

Indeed, according to puppet cert list $h on the server, the certificate was revoked. I cleaned it on the master, deleted the /var/lib/puppet/ssl on the client and all was fine.

I then ran puppet cert list --all | grep revoked -- and found over 20 other clients listed as "revoked" too. Spot checking the list I found, that puppet-agent did not have a problem on any of these others.

My questions:

1. What would cause Puppet to "revoke" a particular client's certificate? It certainly was not done by a human administrator...
2. Why would such revokations not break things for most clients -- but only for some?

Using puppet-2.7.25 on the clients (RHEL6) and 2.7.18 on the server (RHEL5). Thanks!