I'm having the same/similar issue. When importing a 'new' FortiGate in
the ADOM, in our case they come from another ADOM, some address groups
are 'smaller' on the imported FortiGate. This then creates automatically
a "Per-Device Mapping" for that gro...