SCCM 2012 - some remote clients unable to download some applications, 401.2 error

I've got a small SCCM 2012 deployment with about 35 clients attached. Most of these clients are in the same network as the single SCCM host, but three are about 1000 miles away.

Oddly, these three clients have stopped being able to download some application packages over BITS. Publishing a new package works for all the other clients, but for these three it never seems to download. If I go to the software centre, it just hangs at "0% downloaded".

On the client, the DataTransfer.log says (repeatedly):

CDTSJob::HandleErrors: DTS Job '{2DCBBB4C-6D84-479A-9218-885B72C834B9}' BITS Job '{E78147DD-4A26-4942-B4FD-6EC3EB77EECD}' under user 'S-1-5-18' OldErrorCount 442 NewErrorCount 443 ErrorCode 0x80072EE2    DataTransferService 30/07/2012 09:27:41 2964 (0x0B94)
CDTSJob::HandleErrors: DTS Job ID='{2DCBBB4C-6D84-479A-9218-885B72C834B9}' URL='http://sccm-host:80/SMS_DP_SMSPKG$/Content_3e7f6982-6346-4f27-ae00-ad5dcb391455.1' ProtType=1   DataTransferService 30/07/2012 09:27:41 2964 (0x0B94)

Cas.log says (repeatedly):

Location update from CTM for content Content_3e7f6982-6346-4f27-ae00-ad5dcb391455.1 and request {AD041FCB-03D2-4FE6-A6FA-38A6B80FB2A1}  ContentAccess   30/07/2012 08:33:39 5048 (0x13B8)
Download location found 0 - http://lonsbrndsccm02.mcs.int.thomsonreuters.com/SMS_DP_SMSPKG$/Content_3e7f6982-6346-4f27-ae00-ad5dcb391455.1  ContentAccess   30/07/2012 08:33:39 5048 (0x13B8)
Download request only, ignoring location update ContentAccess   30/07/2012 08:33:39 5048 (0x13B8)

On the server, I've enabled failed request log tracing. The raw IIS log says the following:

2012-07-30 08:28:42 10.13.111.35 GET /SMS_DP_SMSPKG$/Content_3e7f6982-6346-4f27-ae00-ad5dcb391455.1/sccm /NSCP-0.4.0.172-x64.msi 80 - 10.2.27.19 Microsoft+BITS/7.5 401 2 5 293

Which is a 401.2 error, meaning access denied. The failed request log is large, but the punchline is that it chucks out a Unauthorized: Access is denied due to invalid credentials. message.

All clients are members of the same domain and appear to be (otherwise) working great. I've re-installed the SCCM client, deleted and re-added the computer to SCCM.

Some other packages seem to work fine, the daily anti-malware delta gets downloaded and patched without issue.

Why are these packages failing?

Unsure if you resolved this yet, I'm dealing with similar issues but have found this article to help with some, but not all, clients having this issue.

http://support.microsoft.com/kb/2682514