This could be happening if the offline policy is not in sync with the policy on the policy server. If the offline policy doesn't have the up-to-date rules, it might be rejecting the sessions.
Please run "pmpolicyplugin -s" on the sudo plugin host should show the policy version number of the offline copy. This should match the policy version displayed using the "pmpolicy masterstatus" command on the policy server. "pmpolicyplugin -g" on the sudo plugin host should try to update the offline copy.
If there are multiple policy servers in the policy group, the custom should also run "pmpolicy masterstatus" on each of the policy servers, to ensure that they are in sync.