How long will you let idle connections last in the captive portal? It should be shorter than the DHCP lease. If you get an IP that was authorized with a different MAC, bad things happen.
On site right now and captive portable idle was set for 120 minutes and DHCP was set to default time which is also 120 minutes. I left the portal at 120 minutes and set DHCP lease for 300 minutes.
Will see what happens.