I had this phenomenon many years ago with ISE 2.2/2.3 but there were F5 load balancers involved. Sadly I can't recall what the resolution was. Perhaps you already have, but my checklist would check the following
Check that 9800 Integration Guide that Adam posted and compare your IOS-XE configuration and ISE configuration as close as possible. Adam makes a good point about the CoA - check that on the 9800 the IP address of ISE is listed as a client and if need be, re-enter the RADIUS pre-shared key exactly as it appears in ISE for that 9800 (rule that out just to preserve your own sanity!)
show run | sec radius
show run | in aaa
show run | in http
show run | sec access-list
Enable a tcpdump on the ISE interface and then delete MAC from WLC/ISE and try to catch the issue - analyse in Wireshark for clues
Analyse your RADIUS Policy Set to mimic how the Wireless MAB traffic must flow - post it in the Community if you want and we can also have a look.
By the sounds of it, you have done everything right.
Last resort things:
- Restart the 9800
- Restart ISE (in my experience, restarting ISE doesn't fix authentication issues ... it's usually something else ...)
