I’m having a hard time imagining it working as you say that it is. DHCP isn’t supposed to work that way.
From your description its not clear where its failing. Do you see the iPXE menu but when you select registration or such that is where you are seeing the attemp and the NAK?
I clear picture taking with a mobile phone would help set the context.
The target computer should only pull a dhcp address from the current subnet. There is no way that I know (outside dhcp reservations) to get an IP address outside of where the client is currently located.
If the client is being told something unexpected we can use wireshark with the capture filter of port 67 or port 68 to only capture the dhcp traffic. That wireshark computer only needs to be on the same subnet as the pxe booting computer to capture the traffic. I sure would like to see that pcap to better understand what the target computer is doing. You can either upload the pcap here, or upload it to a file share site and IM me the link and I will take a look at it. Please don’t mask out IP addresses because it makes it much harder to see who the actors are.