Apparently docker service update can sometimes fail to pull the image because the individual swarm nodes aren't authenticated to the private registry. See this job for an example of this failing in our swarm.
The information I found here indicates that adding the --with-registry-auth flag instructs the Swarm to download the image through the swarm manager, using the swarm manager's already stored credentials for the registry. This should keep this issue from happening again.