Interesting. If you're using PSK and not dot1x, I'd suggest two things in the first instance. If it was dot1x, I'd suggest different stuff!
1. When you boot the PCs up and BEFORE the users login, do you see client entries on the controller client list in the right role?
2. How many users per AP roughly, and are they all doing this at the same time?
Linked to question 2, is this a school? i.e. a class of laptops all booting at the same time?
My best guess without hearing answers to these, is that the client laptops aren't connecting before the users login (and by that time, gpupdates are usually missed as the host tries to start them at machine boot usually). This might be because the WiFi card driver/supplicant if any isn't linking the wireless network profiles to the host machine (only the user). I used to see this a lot with the Intel Proset utility which was and still is rubbish (IMHO)...