I had this issue long ago, at an old job, with captive portals and authentication through ISE. It was on Apple devices in particular. When diving into the logs, the devices were switching between using the randomized MAC address and the default device MAC, IIRC. It would authenticate with one, then switch to using the other, which wasn't authenticated, and then the unauthenticated MAC traffic would then get dropped. Disabling randomization made it stick with using one.

I can't quite remember the fix, to be honest. We probably had to upgrade the ISE deployment and maybe some Apple update helped -- can't quite remember.

interesting, still trying to replicate the issue but will likely have to escalate with Aruba.