I have a few of these EAP failures in Analytics, and I can't seem to find out what is causing it.
If I look at the "Connection Event Details" the client suddenly gets a 802.11 Deauthentication after frame 4 in the 4-way handshake.
The SSID is just setup with a simple WPA2 preshared key, so no radius authentication.
You will need a OTA (radio) packet capture or AP support information to find the disconnection reason. On Analytics it will not show you the reason for disconnection/Deauthentication beyond this point.
AP support logs has very limited memory and may not keep the logs for a longer time span. Check the time stamp of AP support log start and end, see if that is covering the time of your client failure, if yes, search for "reason=" this will list up any log entry for any deauth/disconnection with client MAC.
If same client is failing again and again, it is better to connect the client again and run packet captures on the AP (direct option is available only in GUI of v/SZ) or quickly pull the support logs, after client gets disconnected.