Those Attach Rejects should have a cause value, possibly telling a bit more on the reject reason.

I see those quite frequently, the bulk of them are phones trying to roam in a network they're not allowed to though, and some cause the cell is a bit overloaded, some cause the phone sends a wrong tracking area - not sure that's a phone bug or a common scenario where the phone retains an old tracking area, then it tries to connect to the same tracking area - then the phone discovers it's is now in a different tracking area, and after being rejected, it connects with the correct one.

True but they happen because of individual phones. If you have bursts of those across dozens of devices, that indicates it is on the network side. Also, cell tower handoffs usually don't require Attach Rejects and are generally normal routine operations.