Hotspot with multiple servers keeps NATing to wrong addresses

Hello,
currently we have a setup with two hotspots running on different VLANs. They live in different Networks: 192.168.200.0/24 for guests, 192.168.40.0/24 for internal users. Addresses are distributed via DHCP and devices receive correct IPs. However, after authentication (we use userman as an authentication server), we can observe a false one to one NATing: Internal Clients are often NATed to Addresses of the guests network, this makes the network unusable:

 > /ip hotspot host print
 #    MAC-ADDRESS       ADDRESS         TO-ADDRESS      SERVER
0 H  B8:*: 192.168.200.99  192.168.200.99  guest
1 H  00:*: 192.168.40.65   192.168.40.65  internal
2  A 6A:*: 192.168.40.12   192.168.200.84  internal
3  A 88:*: 192.168.40.43   192.168.200.83  internal
4 H  6C:*: 192.168.40.10   192.168.40.10   internal
5  A 20:*: 192.168.40.11   192.168.200.85  internal
6  A A8:*: 192.168.40.103  192.168.40.37   internal

The address pool setting for the servers as well as the default users is set to “none”.

Does anyone have an idea where the configuration mistake might have happened?

System:

> /system routerboard print 
routerboard: yes
board-name: hEX
model: RB750Gr3
serial-number: *****
firmware-type: mt7621L
factory-firmware: 3.41
current-firmware: 6.42.5
upgrade-firmware: 6.48.1