IMO....
> there's no point collecting from one MC and not the other
> the MM doesn't really reveal any operationally interesting data in its logs
> Airwave is not a syslog relay and doesn't really generate operationally syslog itself. You could consider to use the Alerts (after a lot of fine tuning) but that will generate traps not syslog
> Clearpass... if you have a generally authenticated user base, this is probably the best choice if you can choose 1 only
If you meant that you could choose "the two MCs" as "1", then there could be further pros and cons between MC or Clearpass depending on what is important (but I don't think that's what was meant?)