Just some thoughts below.
Can you maybe disable encryption and check if the problem persists?
Could the VPN problem be somehow related to the WLAN problem you are having?
Another thing. Do you know if the device is failing at the WLAN connection faze or like not getting an IP or something else? Does it change anything if you configure a static IP on the device?
Does the device associate immediately if you have WiFi on it disabled and you enable it, or does it take that long even if not roaming?
Where is the ZD in this topology? Is it off-site or on site and where? Is there a big latency somewhere maybe?
