By design, ARP entries are permanent for clients getting IP addresses through JDHCP relay (or server) configured on SRX. This is done to prevent ARP spoofing. This article describes how to use the older DHCP process instead of the newer JDHCP process to avoid permanent ARP entries.

This is a typical configuration for DHCP relay:

forwarding-options {
    dhcp-relay {
        server-group {
            dummy-config {
                172.27.201.21;
            }
        }
        active-server-group dummy-config;
        group g1 {
            interface ge-0/0/0.0;
        }
    }
}

Clients connected to ge-0/0/0 will get permanent ARP entries as follows:

MAC Address       Address         Interface     Flags
<...Output Snipped...>
00:1f:16:f6:48:fd 192.168.3.2     ge-0/0/0.0     permanent

Customers getting their IP address through JDHCP process will have permanent ARP entries. This is as per design and is done to prevent ARP spoofing. 

If permanent ARP entries are not desired, customers can use the older DHCP process instead of the newer JDHCP process (starting from Junos OS 12.1) . When done under forwarding-options helpers bootp the configuration uses the older DHCP process and the configuration under forwarding-options dhcp-relay uses the newer JDHCP process. Both are mutually exclusive, that is, they cannot be used together.

forwarding-options {
    helpers {
        bootp {
            server 172.27.201.21;
            interface {
                ge-0/0/0.0;
            }
        }
    }
}

ARP table:

root@240-POE-3# run show arp no-resolve | no-more
MAC Address       Address         Interface     Flags
<...Output Snipped...>
00:26:88:ea:13:00 192.168.3.3     ge-0/0/0.0    none

The same behavior will be seen when a JDHCP server is configured on device.