This is known behavior: according to the iOS 10 Security white paper [1], "iOS uses randomized Media Access Control (MAC) address when conducting Wi-Fi scans while it isn't associated with a Wi-Fi network... Note that Wi-Fi scans which happen while trying to connect to a preferred Wi-Fi Network aren't randomized". I haven't put much thought into it, but I wonder why they don't randomize all probe requests... [1]: htt…
I would assume because MAC-based whitelisting is a commonly used WiFi access control mechanism?
In addition to those who whitelist based on MAC address, some networks also assign "static IPs" via DHCP based on the MAC address.