If these are single-user systems, you can rebuild NM with PolicyKit
disabled so that it never validates requests against PolicyKit.
I'll try rebuilding tomorrow. I suppose (hope) there is clear switch for disabling it.
Could you 'nmcli g log level debug' on a problem machine and grab some
log output from before and after the error?
I don't have access to that machine now, but I'll do that tomorrow.
BTW, I got a feeling that I got more services failed after I enabled openvpn.service (like avahi). Also these problems did not disappear when I disabled openvpn.service and booted card. Same goes with modem problems. So, does NetworkManager or somebody else keep some data regarding OpenVPN set-up even though its been disabled. If so, would it be better managing OpenVPN connection with NetworkManager (-plugin) than using openvpn.service for that. Also is openvpn-plugin build automatically and get into use if tun interface is not configured as unmanaged?