Are these systems joined to an Active Directory domain?  If so, the error about Group Policy should be causing you to look at Group Policy.  It's possible that the affected systems are in a different OU or different site within AD, or that there's a filtering policy on a particular GPO that's applying to some systems and not others.  Group Policy allows you to allow or block various types of startup security options, such as TPM-only, TPM+PIN, etc.  If you're not joined to an AD domain, then Windows 10 Pro machines can technically use a local Group Policy just for that system, so you can check GPEdit.msc to view the local Group Policy settings on the affected systems.  But in an AD environment, for any settings defined both on the local Group Policy an in AD, the AD settings will always prevail.

Or if you set up BitLocker on some systems before joining to AD and are trying to do it after joining to AD on the others, that would account for this too.  For example, if you have a GPO that blocks TPM+PIN but you enabled TPM+PIN before joining to AD, then Group Policy doesn't force you to change that later, but if you ever switched to TPM-only, you wouldn't be able to enable it again while joined to the domain.  That policy is only evaluated when you attempt to SET the startup security.