I thought you meant finding managed systems that don't have osquery, not the other way around. Yeah DHCP logs are great for that