Okay,
Here's my scenario:
Yea, the Self-contained exe was created from the standard agent and distributed to remote clients.
Now the remote clients previously had an old agent plus cert from the old Core which caused the agents to remain in Direct mode when taken off the internal network. I figured this out while going through the step by step instructions for the CSA cos support never got back to me with a solution (hence my previous comment). Turns out that after deleting the old cert (@ %LDMS_LOCAL_DIR%\Shared Files\cbaroot\certs) the agent immediately switched to gateway mode. I went on to delete the items in the broker folder prior to installing the agent on a remote machine and the device showed up immediately on my Core.
Now your brilliant response (much appreciated) still doesn't address the fact that some devices show up on the core while others don't.
I have just checked the files you mentioned on my machine and I am setting up 2 computers to test the agent installation off-net just like my remote users. I will get back to you with my findings asap.
PS: I really appreciate your time and assistance. I am just new to LD and I want to learn as much from every issue I experience.