I wanted to post the resolution in the event that there's someone else out there struggling with this issue:
We were able to reproduce the issue by standing under an AP and toggling WiFi off/on, traveling past two neighboring APs in a line, travel halfway to the third neighboring AP and stop. The device would drop to 1 signal strength bar and disassociate from the SSID in most cases.
Resetting network settings or restoring the iOS would remedy the problem, but only for ~15-30min and then the issue would return. Our MDM (Hexnode) was ruled by performing the iOS restore and not applying any profiles to the device. Many WLC changes were implemented & tested, but we could only make the issue worse vs. better.
We brought an outside iPad into the environment for testing and it did NOT experience the same issue. Matched all settings and it still didn't experience the issue. It also had a JAMF profile applied, so further stressing that a profile incompatibility was not the root source.
The only other difference was that the outside iPad wasn't logged in to iCloud. Signing one of ours out of iCloud resolved the failure to roam issue for >= 30min. Signing it back in to iCloud brought the issue back. The only component of iCloud we use is 'Find my', but all syncs default to 'On' and must be manually toggled 'Off'. The only local content from all of the syncs was the Keychain.
I wondered if an old WiFi login entry was stored in the iCloud Keychain, but the only airport entry listed in Keychain Access was for our Guest SSID. I removed all login entries, reset the Keychain, removed all of the 'Standard' entries again, enabled the Keychain sync on our iPads (to bring down an empty Keychain) and the issue was eliminated. My explanation is that the Keychain was corrupt. For the time being, I have signed all iPads out of iCloud to ensure that the Keychain doesn't corrupt again and/or re-propagate throughout our devices and all is working as expected again.
