Another vote for Omada.

I can’t tell from your diagram but are you using the WAN ports on any of your downstream devices? Did you disable DHCP on them? They should be providing layer2 access only. Leaving those L3 services on can cause all sorts of odd issues.

Omada is cheap but their router isn’t simple. Their poe switch and APs work but you’ll need a controller. I use the oc200.