If you are sure about no changes were made on the device web UI, we can take the techsupport dump from one of the AP and compare the configuration with cnMaestro.
I would suggest to enable "Lock AP" fetaure under Application > Server, this would help you to overwrite any Wi-Fi AP configuration changes made outside of cnMaestro.
I checked the tech support dump and there are scmd crash files in it. Once scmd crash happens device agent process(This is the process responsible for the device and management system communication) will go for a restart and the config sync status shows out of sync . We have identified a similar scenario locally and the same will be fixed as part of upcoming release 4.0 scheduled tentatively for september end. It will be great if you can also let us know what configuration changes will be commonly made from cnmaestro and then pushed to AP