I would start with a putty session to the controller and issue
#1 - 'show user | include Ap-NAME', where AP-NAME == the RAP in question.
#2 - Once you have the # of unique users on that AP. Find the ones using split tunnel and issue this command:
'show datapath session table | include x.x.x.x' where x.x.x.x == IP address of each unique user.
The output of these commands will give you the user count, the destination IP, source port, and the destination port of the traffic being observed by the controller.
Let us know how you make out
JF