Hi Colin, I tried as you suggested:
first I enabled the eapol-rate-opt and cycled the adapter on the wpa_supplicant that was having issues. It was not able to complete the authentication.
I then undid the probe response level (not sure how that got turned on, but it was on the 5x config), no change. I changed the TX rates to be 12 and up, no change.
Then I changed the basic rates to 12 (as the ASE tool and you suggested) and boom, client connected.
So the real issue was my screwy basic rate settings. I had no idea they had to be a subset of the tx rates, for some reason I thought it should always be 1 and 2.
I changed these settings on the other SSID profiles as well. Thanks for the help, I bet it will make things run smoother for now on.