This issue was caused by changeset files that referenced the version 3.5 Liquibase schema. Liquibase 3.5 is available in Fedora (which most of our developers use) but only 3.1 is available in RHEL. When Liquibase parses a changelog file and sees a version of the schema that isn't available (i.e. not packaged in the Liquibase jar file) it attempts to access the schema over http. Version 3.1 is less that 3.5 so any RHEL 7 machine is going to download the schema. In the disconnected case, the schema is unreachable and Liquibase fails.
Users encountering this bug can fix it manually using sed: $ sed -i '1,10s/3.5.xsd/3.1.xsd/' /var/lib/tomcat/webapps/candlepin/WEB-INF/classes/db/changelog/*.xml