Is there a way to automatically logout a hotspot user once they switch to a different VLAN?
Found the answer myself
its probably a bug in 5.11.
Upgraded (manually as auto upgrade is not implemented in 5.11) to 5.26 and everything works fine.
False alarm after all...