It's a known issue. If a mobile phone connects to the wireless, and then the person decides to disconnect and enable their hotspot on that phone, it will trigger Air Marshal to detect it as a 'Rogue' for being 'Seen on LAN'. No known fix as far as I know.
While it may be a bug, we leverage it to investigate coverage holes. Our environment is fairly isolated. If someone's been on our network before and then fires up a hotspot it is most likely because we're providing poor coverage. We send the user an email and ask if they were encountering a problem with our network. We also suggest that their use of a hotspot often serves to make any problem worse. (Makes us real popular 🙂