I'm using a Vigor 2860Vac with two wired AP-910Cs, which I've set up to work with Central AP Management.

Each AP is set up identically, as an Access Point (as opposed to Universal Repeater, etc.). I'm using 5G only, WPA2 and the same SSID on all three Draytek devices (the SSID is not hidden).

The two APs show up 'green' in the router's Central AP Management. All seems ok, and it is for a while after rebooting devices, but eventually, one by one, the APs stops allowing mobile devices to connect. When the AP's signal is selected on a mobile device, it tries to connect and then asks for the password, although this is already stored in the mobile device. The password is rejected even if entered manually.

In case it's relevant, the mobile devices are iOS - and it seems to happen on all of them - so I'm satisfied it's not a problem with a particular iOS device.

The AP's Syslogs seem to include a lot of the following (Mac addresses etc. have been replaced with Xs):

Sep 22 21:11:29 kernel: Athr: Remove associated mac: XXXXXXXXXX from switch table...
Sep 22 21:11:29 kernel: TXRX: ol_txrx_peer_find_add_id: peer XXXXXXXXXX ID 52 vid 0 mac XXXXXXXXXXXXXX
Sep 22 21:11:29 kernel: Negotiated: txrates = fffa rxrates = fffa
Sep 22 21:11:29 kernel: Node deleted (NC = 0)
Sep 22 21:11:29 kernel: TXRX: ol_rx_peer_unmap_handler: peer XXXXXXXXXXXX with ID 52 to be unmapped.
Sep 22 21:11:29 kernel: [ieee80211_ioctl_setmlme] non sta mode, skip to set bssid

Also perhaps of relevance, under AP-assisted Client Roaming Parameters, I have checked Minimum Basic Rate (set at 9Mbps) and Minimum RSSI (set at -66 dBm). I'm not certain if that's the best setting for this scenario. Obviously I'm aiming for reasonably seamless movement from one WiFi AP to another (including the router itself).

Any suggested solutions are much appreciated. I have tried setting up a Radius server for 'seamless' roaming, but couldn't get any devices connecting at all, so hence have reverted to this set-up.

Thanks!