With TAC help I was able to solve the issue. We were using SNMPv3 with Authentication, but no privacy in the Design/Network Settings/Device Credentials/SNMP Credentials. DNAC as of 1.2.8 will not completely authenticate the device unless you are using Authentication with privacy. We created a new SNMPv3 credential with privacy and the device successfully onboarded and moved into the inventory.

This doesn't affect our "Discovered" devices, only the ones we are attempting to onboard with Plug and Play.

There is a Bug ID for this issue (Cisco didn't provide it to me) so they know it is an issue and will hopefully correct the issue in a future release. I hope this helps someone else...