I understand that its happening all over campus and I was suggesting that you just look at one client and see if they are connected to an AP then either roam or get moved by client match and see if that is the issue.
Im not saying that is the issue but It will give you a starting point.
Timeout is normally an issue with the client not responding to a challenge or there is to much latency in the wired/wireless side.
If it was a bunch of failed auths then I would first point to CPPM.
From what it sounds like without looking at it live. Your clearpass and AAA settings are fine. You need to look into the settings on the SSID.
Power levels
Is client match enabled
thresholds
ETC
@cjoseph do you have any thoughts