Is anyone else seeing this? I had a similar problem in the past and people added in the ability to delete a DHCP entry from the table. Things have been stable for a few months now and, all of a sudden, after updating to 26.7.1_1, my address pool is getting exhausted. Normally, I am only using 2-3 addresses in a pool of 30+. These "declined" entries have a lifetime of 600 (instead of the default lifetime of 4000 which all of my "real" entries are set to). I'll have to try to do a wireshark trace to find out if anything sending out DHC requests on my network, but I am not aware of any new devices on my network or any config changes. As far as I know, the only recent change was updating to 26.7.1_1.
Luckily, it appears that my static pool is not being erroneously over-ridden (like it was last time) so, as long as I have static entries for the devices I want on the network (or existing dynamic entries), it is working fine.
What does "declined" mean as a "state" in the KeaDHCP Lease table? If OpnSense declined a DHCP request, why burn an entry in the Lease table? Even if it is for a shorter amount of time.
You probably have a faulty client polluting your leases.
https://github.com/opnsense/core/pull/10294