All our products have a super capacitor to supply power to the real time clock for a couple of hours (about a day actually). If the machine is detached from a power source for a longer period of time, the
supercap will drain, the RTC will lose power and the time will be lost. I believe the use of a
supercap instead of a battery was a deliberate decision to avoid having to ever open the case for battery replacement over a lifetime of potentially decades. The expectation is that the machines are usually powered 24/7 and that any power outages would normally not exceed several hours.
Once the RTC has lost power, the time will be reset on boot to the
release date of systemd. You can then set the clock automatically via NTP (which is enabled by default in our image) or by attaching a GPS or DCF77 receiver. Alternatively, disable ntp and set the clock manually using timedatectl(1).
What you've reported in your post of Oct 23 sounds like the machines were removed from a power source for a sufficiently long period of time such that the
supercap was drained. After enabling ntp, they picked up the correct time on boot.
I'm somewhat confused about what you reported in your post of Oct 29. You've disabled ntp, set the time manually and it later jumped back to the manually assigned time? That would be odd indeed.