Ok. Turn off mobile data on the device. Connect to the guest network and don't login.
Find out the IP address on the mobiledevice.
On the controller CLI run the following command quickly after accessing the internet using the apps that have access.
#show datapath session table | include <mobile device IP>
This will show us the traffic that the controllers see coming from and going to your device.
Out of interest, what do you think still have access?
Also the GCC_LAN and http policies seem a little redundant. Is there a reason for them being there?
Cheers
James