Windows 10 allows users to create Wi-Fi hotspots, which work quite well... However, from our perspective, this is a rogue AP because it allows access to the LAN by random devices. Can we detect the creation of a Wi-Fi hotspot using the Meraki?
Have you been expanding the time window for which the rouge SSIDs are being displayed? I have found that it can be kind of tricky to catch a phone under the Rouge SSIDs tab of the Air Marshal page since they only show up briefly. If you go to "Network-wide > Alerts > Network-wide" and check the box for "A rouge AP is detected" you'll get an email notification a few minutes after someone attempts to use a hotspot. I have found this to be the most helpful so I am not just trying to chase hotspot attempts.
What model of MR's are you running and can you post a screenshot of your Air Marshal configuration?