I do not understand how "wlccp ap mobility" fixes the problem.
"wlccp_ap_st_leap_auth" means that the infrastructure AP is authenticating against the WDS device (either a WLSM or WDS AP) via LEAP. If the AP stays at "wlccp_ap_st_leap_auth", it looks like that the WDS device has problem to communicate with the radius server or the LEAP authentication fails. Can you post the configuration of the WDS device please? Also, please provide the output of debug radius auth.