Looking at the attachment I notice that the signal strength is relatively low even if the AP is meters away. At that level the client will be most likely looking for other APs to connect to. Do you have the cache settings so that the devices can roam between neighbors without having to re-authenticate? What is the power level of the APs in the area? Are there other wireless systems in the area that clients can hear?
You may want to do a spectrum analysis to see how crowded the environment is. Then there is the chance that your clients may be getting deauthed by either a bad actor or yourself. Do you have WIPs enabled? Check the ACSP Neighbors to see what the APs can see in the area. How many networks can a laptop see in the area?
On a side note if all three groups are using WPA-Enterprise is there any reason you do not have them authenticating to one SSID and then assigning them to the desired vlan based on the radius attribute and client classification? The fewer SSIDs you have the faster and more stable you environment will be. I serve 1000+ clients on 20+ VLANs all on one SSID.
Remember in the end you cannot control the clients, you can only encourage them to do things but if they want to constantly disconnect you cannot control it. In you case you have several different clients acting the same way so you are correct to look at your system but also look at the environment. Your AP is not disconnecting the client, the client is disconnecting itself. The magic question is why. So what could cause the client to keep looking away from your AP?
