The AP's send unicast ARP's to the configured Default Gateway (ARPings) to verify they have connectivity. Make sure your gateway is responding to these ARP's. AP's that think they lost contact to the Default Gateway will transmit the recovery SSID to allow accessing the AP that might be remotely mounted to diagnose the issue.
An AP that has been under SZ control use the AP admin password as PSK for access to recovery SSID.
Hope this helps.