Windows Server 2008 R2 DHCP Server with multiple DNS servers

Personally, I would try running Wireshark to capture the traffic between the ISC DHPC server and your Windows DNS servers. The logging for Microsoft DNS is certainly not perfect, so this would be helpful.

That being said, are you restrict updates in DNS to "secure" updates (meaning authenticated connections only)? If so, my guess is that the ISC server cannot authenticate against the Windows DNS infrastructure and the updates are failing. I would try turning unsecured updates in that case assuming this is a private/trusted network.

After reading some of the BPA stuff, BPA is possibly complaining too much.

1. According to the doc, "The loopback address should be configured only as a secondary or tertiary DNS server on a domain controller." You've done this. False fail.
2. This step checks the list of servers on the "Zone Transfers" tab and checks those. Verify THAT lists only valid secondaries. Remove any that don't belong.
3. The failure here is, "A DNS server that is configured on the network adapter was unable to resolve the start of authority (SOA) record for the forest root domain name." If you're using NSLOOKUP, set your type to SOA (set type=SOA) and see if you can get the forest root. If all of the DNS servers on your tabs will resolve the SOA record, this is a false fail.
4. This is the same as the previous point, but with a different DNS domain.
5. This checks the DNS servers listed in the Zone Transfers tab for ability to resolve the primary zones. If point 2 failed, this is likely to fail too.

The Best Practices Analyzer documentation for Server 2008R2 is located here: http://technet.microsoft.com/en-us/library/dd392255%28WS.10%29.aspx

Why is it doing the false-fails? I couldn't tell you. If you've verified that it works using manual methods, it's time to contact Microsoft.