I was checking the logs and I think I found the issue: after the AP joins the controller, the controller constains it as a rogue AP
*spamApTask0: Jun 13 00:09:01.750: #LWAPP-1-AP_CONTAINED: spam_lrad.c:37697 AP APfc5b.394f.c4b5 is being contained on slot 0
Where APfc5b.394f.c4b5 is the AP that has joined the controller.
How can I change this behaviour? the AP is not listed under 'Malicious Rogue APs'