R6400v2 blocked mac address still connects

I have spent a bunch of time trying to work through the access control, to prevent some rogue actor from connecting at all to my r6400v2, so far to no avail. The intruder mac address has been blocked in the access control list, it shows up as "blocked" and does not appear in the list of attached devices, but in the logs it repeatedly connects and acquires a DHCP address, eg:

[DHCP IP: (192.168.1.20)] to MAC address 6A:F0:F3:0B:AA:B2, Friday, Nov 05,2021 07:43:14
[DHCP IP: (192.168.1.20)] to MAC address 6A:F0:F3:0B:AA:B2, Friday, Nov 05,2021 07:40:59
[DHCP IP: (192.168.1.20)] to MAC address 6A:F0:F3:0B:AA:B2, Friday, Nov 05,2021 07:38:26
[DHCP IP: (192.168.1.20)] to MAC address 6A:F0:F3:0B:AA:B2, Friday, Nov 05,2021 07:31:05
[DHCP IP: (192.168.1.20)] to MAC address 6A:F0:F3:0B:AA:B2, Friday, Nov 05,2021 07:18:53
[DHCP IP: (192.168.1.20)] to MAC address 6A:F0:F3:0B:AA:B2, Friday, Nov 05,2021 07:12:43

This has been going on periodically ever since I installed the router last week.

I don't understand why a blocked mac address should ever be granted an IP on my local network, even if it is somehow bumped off shortly after connecting, is it not possible that it can acquire some knowledge of the internal network traffic or architecture during that time? Why allow it to connect at all if it is listed as blocked? I assume the mac address is part of the connection request, so why not block it outright?