I know WHY!
1st device sent request to DHCP and he asked only for Router!:
Jan/01/2002 01:01:02 dhcp,debug dhcp1 received request id 353977549 from 0.0.0.0 ''
Jan/01/2002 01:01:02 dhcp,debug,packet flags = broadcast
Jan/01/2002 01:01:02 dhcp,debug,packet ciaddr = 0.0.0.0
Jan/01/2002 01:01:02 dhcp,debug,packet chaddr = D8:18:2B:9C:5B:47
Jan/01/2002 01:01:02 dhcp,debug,packet Msg-Type = request
Jan/01/2002 01:01:02 dhcp,debug,packet Host-Name = "DEVICE9C5B47"
Jan/01/2002 01:01:02 dhcp,debug,packet Parameter-List = Router
Jan/01/2002 01:01:02 dhcp,debug,packet Address-Request = 192.168.16.131
....
....
For example my smartphone asked much more:
Parameter-List = Subnet-Mask,Router,Domain-Server,Domain-Name,Interface-MTU,Broadcast-Address,Address-Time,Renewal-Time,Rebinding-Time,Vendor-Specific,Captive-Portal,Unknown(108)
.....
.....
and two other devices asked for more parameters too:
Jan/01/2002 01:01:02 dhcp,debug dhcp1 received discover id 64235312 from 0.0.0.0 '1:0:1c:d7:af:6b:42'
Jan/01/2002 01:01:02 dhcp,debug,packet secs = 4
Jan/01/2002 01:01:02 dhcp,debug,packet flags = broadcast
Jan/01/2002 01:01:02 dhcp,debug,packet ciaddr = 0.0.0.0
Jan/01/2002 01:01:02 dhcp,debug,packet chaddr = 00:1C:D7:AF:6B:42
Jan/01/2002 01:01:02 dhcp,debug,packet Msg-Type = discover
Jan/01/2002 01:01:02 dhcp,debug,packet Client-Id = 01-00-1C-D7-AF-6B-42
Jan/01/2002 01:01:02 dhcp,debug,packet Host-Name = "DEVICEAF6B42"
Jan/01/2002 01:01:02 dhcp,debug,packet Parameter-List = Subnet-Mask,Domain-Server,Host-Name,Domain-Name,Router,Broadcast-Address
Jan/01/2002 01:01:02 dhcp,debug dhcp1 received discover id 3026077200 from 0.0.0.0 '1:74:e1:82:50:4a:c6'
Jan/01/2002 01:01:02 dhcp,debug,packet secs = 4
Jan/01/2002 01:01:02 dhcp,debug,packet flags = broadcast
Jan/01/2002 01:01:02 dhcp,debug,packet ciaddr = 0.0.0.0
Jan/01/2002 01:01:02 dhcp,debug,packet chaddr = 74:E1:82:50:4A:C6
Jan/01/2002 01:01:02 dhcp,debug,packet Msg-Type = discover
Jan/01/2002 01:01:02 dhcp,debug,packet Client-Id = 01-74-E1-82-50-4A-C6
Jan/01/2002 01:01:02 dhcp,debug,packet Host-Name = "DEVICE504AC6"
Jan/01/2002 01:01:02 dhcp,debug,packet Parameter-List = Subnet-Mask,Domain-Server,Host-Name,Domain-Name,Router,Broadcast-Address
....
....
Is this device in the lease table? As static entry? Seems not, "not found", "arp added"
Yes. All 3 devices is in DHCP leases table and ARP, but not static
....
....
I understand you want to "fix it" with DNAT. But that would probably not be made specidic for the 1/3 device, as the destination will be a broadcast address.
I think there is no issue if it will work for all devices