Weird VLAN issue with 2 VLANs on 2 APs and Edgerouter-X

Hi,

posted a shorter version of this two weeks ago.
No answer, so I hope this more detailed post might trigger someone's memory.

I am using an Edgerouter-X-SFP connected to the ISP via fiber. Internal DNS and DHCP are provided via dnsmasq.

I have 2 WLANs spread over 2 APs (AC-Lite): Friends and Home. Both APs are connected directly to Ethernet ports of the EdgeRouter-X. The Friends WLAN network uses switch.0.23 and Home uses straight switch0 on the Edgerouter-X. Firewall rules restrict Friends to Internet and the router, the Home network is blocked.

Since a few days, the living room AP has issues with the Friends WLAN but not the Home WLAN. In contrast, the Office AP works perfectly fine with both WLANs. Which is totally weird, as the network config is the same (via the UOS Server) on both APs and the dnsmasq config is set up on the VLANs, not AP specific.

On Friends the living room AP allows the devices to connect, but it does not provide an IP address (with Linux, as well as Android, IOS or the Amazon Fire Stick). I can see the DHCP requests with tcpdump on the AP. But I cannot see them on the router.

I nuked the WLAN/VLAN config for the APs and recreated it. No change.
I nuked the VLAN config and firewall rules on the router and recreated them, no change
I activated logging on all firewall rules. Nothing to see here.
I swapped the router connections, the effect is still in the living room.
I also swapped the APs, the effect is still in the living room.
I even exchanged my old AP lite with an AP 7 lite, still no change.

I am totally at a loss to explain this behavior or find a reason. Any ideas what to check where?Heeeeeeelp!