This must be something to do with the fact that the x86 VMC doesn't have a TPM / factory cert.
I'm getting exactly the same behaviour when trying to convert an IAP-207 to a RAP:
From Controller:
Apr 25 15:08:58 <isakmpd 103061> <5314> <ERRS> |ike| IKE_CUSTOM_useCert: can't find Server-Cert
Apr 25 15:10:02 <isakmpd 103061> <5314> <ERRS> |ike| IKE_CUSTOM_useCert: can't find Server-Cert
Apr 25 15:11:05 <isakmpd 103061> <5314> <ERRS> |ike| IKE_CUSTOM_useCert: can't find Server-Cert
2017-04-25 03:09:32 ConnectTo: <public IP>
2017-04-25 03:09:32 SEND: cf1a3837ac4d970a : 0000000000000000 , np=33, EXHG: IKE_SA_INIT
2017-04-25 03:09:33 RECV: cf1a3837ac4d970a : 0000000000000000 , np=41, EXHG: IKE_SA_INIT
2017-04-25 03:09:33 SEND: cf1a3837ac4d970a : 0000000000000000 , np=41, EXHG: IKE_SA_INIT
2017-04-25 03:09:33 RECV: cf1a3837ac4d970a : 9d7fafd274f753f0 , np=33, EXHG: IKE_SA_INIT
2017-04-25 03:09:33 SEND: cf1a3837ac4d970a : 9d7fafd274f753f0 , np=46, EXHG: IKE_AUTH
2017-04-25 03:09:37 SEND: cf1a3837ac4d970a : 9d7fafd274f753f0 , np=46, EXHG: IKE_AUTH
2017-04-25 03:09:43 SEND: cf1a3837ac4d970a : 9d7fafd274f753f0 , np=46, EXHG: IKE_AUTH
2017-04-25 03:09:48 SEND: cf1a3837ac4d970a : 9d7fafd274f753f0 , np=46, EXHG: IKE_AUTH
2017-04-25 03:09:53IKE FAILED err: RC_ERROR_IKEP2_PKT1