My bet is that it is looking for a Domain Controller to authenticate to in order to receive an updated access token as well as everything else that is part of belonging to a "Domain" like....Group Policy information, etc., before it finally gives up and flips over to cached credentials.
Why would you join it to a domain and then disconnect it from the network??? Seems an odd thing to do.