From Google: When IPsec is being used, it is customary to set the MTU size on the tunnel interfaces to 1,400 bytes and to set the TCP-MSS-adjust to 1,360 bytes. This can be configured in a Cisco IOS device using these commands.

Look at MTU.  IPSEC site to site has an overhead and your CAPWAP might be too big to fit in it.

As far as I know, yes. I've been using CMX for a few years now. CMX is becoming obsolete, I am still stuck with it at this time but my understanding is that DNA Space will do the same and probably more but until I experience it myself, I can't tell y...

My DNA center is sync with CMX. CMX sees the client and is able to place them on the floor. DNA reports that mostly all clients are "unpositionned" 

I was able to resolve that Issue with TAC. We run dual failover appliances. I moved the logging to the secondary and issue was resolved.