The current ble phy driver for the nrf52 counts occasional errors when decrypting received frames. What we see is that the CCM peripheral does not set the ENDCRYPT event, indicating that decryption never finished (or even started although we do see the ENDKSGEN event which signifies we generated the key stream). When this occurs there is no other indication; the CRC check passes and it passes the MIC. Note that we only see this occurring for LL empty PDU's. These packets have zero length and are supposed to pass through the CCM engine as empty pdu's are not encrypted.
A note on this bug: this only occurs when the device is the slave, not the master.