What kind of radius server are you using? Is it possible that you've unintentionally set a short reauthentication timer? If they are authenticating correctly and passing traffic between these short authentication times, it sounds like maybe someone confused perhaps a reassociation timer with the key rotation timer.