If the new client certificate were NOT to be trusted by ISE, then ISE would very clearly report that in the TLS setup error messages. In your case, this should not be happening, since you mentioned that the issuing CA has not changed (and that same CA chain is still installed in the ISE Trusted Certificates list)
In the past, when I have seen this error, it's been a transient condition - meaning - the clients are roaming into areas of bad coverage and they fail to complete the TLS communication (and there are re-transmissions involved). Either that, or the WLC is still hanging on to cached keying material from previous sessions and this is causing confusion (e.g. CCKM, 802.11r or OKC)
I would try deleting the client session on the WLC and watching the ISE Live Logs.
If this condition does not clear, then check whether you have perhaps changed any other settings in ISE (e.g. changed some TLS security settings perhaps?).
You could also check whether the Layer 3 gateway (SVI) of the VLAN that ISE PSN is connected to, has MTU set to 1500 bytes. Any MTU larger than that will cause these errors as well. It can happen that a certificate transfer exceeds the MTU and ISE cannot handle MTU larger than 1500 bytes.
Failing that, run an endpoint debug for the client MAC address and see what ISE captures. It should capture the client certificate that the client is trying to present to ISE. Along with a lot of debug information - it might give you a clue.
