Could you provide more information so I'd turn on my glass sphere....
- AP model
- is the tunnel from the AP to the controller a ....normal tunnel, control tunnel encryption, or both data/control tunnel encryption
- have you tried to reduce the AP MTU to 1300
- are all the required ports open on the VPN link i.e. FTP 69 both directions
- if you turn off AP automatic software upgrade is the tunnel stable to the AP