You can still sync the 8540 since it's in the inventory of the DNAC even if you don't manage it from DNAC. And if it's not in the inventory, then how does DNAC even know about the APs? But I agree, you shouldn't have to. And the recurring sync should...

A manual sync should do the trick to inform DNAC of which controller the APs are connected to. Potentially it could help to manually sync with both WLC if both are managed by DNAC. Enhancements of AP discovery was also introduced in version 2.3.7.6. ...

But those are the authorization profiles you've named WirelessGuestCWA_ISE1 and 2. How does the authorization profile that is named WirelessGuest look?

Okey, nothing wrong there with the authorization rules. How does the authorization profile WirelessGuest look?