Jon , is GTAC already involved? Do you use radius client on AP or controller?
They would need to take traces from hostapd on AP/radclient and on the RADIUS server and see where the delay is . Do you know and have access to the whole path between NAS and RADIUS?