There is a configurable idle timeout under Configuration > Authentication > Advanced. The default is 300 seconds (5 min).
After no traffic has been seen from the user in 5 min (or what ever the setting above is set to), the controller will attempt to contact the user (ICMP or ARP) to see if the user is still active. If the user is not active, the controller will remove the user from the user table.
I am not sure what circumstance causes "N/A" to appear under the AP name, but like I said, I have seen it from time to time.