Is indeed something 4.3.21 does on OPAL.
The beta 4.7.2 version is very stable on OPAL compared to 4.3.21 which does bring down the WAN connection and firewall rules when roaming. Roaming happens when there are multiple AP with the same SSID, or when the OPAL knows passwords for other SSID.
BSSID lock is not simple in 4.3.21 and 4.7.2beta has also more options to control multiWAN.