I think that you guys have proven a suspicion that i have had about the sysprep for some time now, which is that there is some parallel processes working during sysprep, and the process that's updating the sysprep unattend file (the one that redacts passwords and marks sections as completed) is actually not done by the time sysprep also reboots the system (the other parallel process). Adding in this delay timer has resolved the problem by allowing that rewriting process to get done before that reboot happens.
BTW.. everyone should be capturing their images generalized, so they can cut down the time sysprep actually runs. Running auditmode, and generalize in the image is a lot of time wasted. Just MO. Some folks have reasons to do it, but best practice is not to do it this way, if at all possible.
cheers.