Based on the user guide for the remote agent, the database group mapping is anchored by the messaging received from the CSWinAgent. It seems as if you do not setup a cluster (primary and secondary) that this mapping will be lost when you add another RA.
The CSWinAgent service is included only in the Windows remote agent. It is the service that supports Microsoft Windows authentication. It is controlled by CSAgent but it receives authentication requests from appliances directly on the ports it is configured to listen to. It supports authentication of users and machines, user password changes, and retrieval of group memberships. CSWinAgent makes no decisions about user access. Instead, it passes the results of its Microsoft Windows queries on to the appliance initiating the query.
I dont mean to "kick you" while you are down but this what makes ACS 5.x more favorable you it is policy based so you dont have to map groups anymore.