So let me summarize: We have clients on the local subnet which are actively using pihole and despite it checks the ARP cache every minute there are situations where the cache has no entry for that device? That's strange....
What about my second suggestion: Taking snapshots of ARP's cache?
You could try to go upwards with the time in small steps, hoping to avoid a 12h assumption. Start with check the snapshot at t-1 minute as well (maybe it is just a ARP hickup and the device was still present 1 minute ago). The earlier we find a device the more likely it is really the "same device".