Edit: I just noticed that you don't have ip addresses on any of the interfaces except for the bridgeLocal so it isn't "configured as a router". Sorry if I led you down the wrong path; as long as there is no ip address associated with an interface, it won't have a connected route for the interface, so it won't normally route through that interface. So having those vlan interfaces (without any ip addresses) shouldn't cause a problem (and may give you the option of connecting with winbox as long as you can send and receive tagged frames).
However, you have access to the bridgeLocal interface blocked because of the frame-type filtering.
More details in this post.
--- original post follows ----
After a cursory look, the one thing that jumped out is that you have CAP02 (hAP ax^3) configured as a router instead of just a managed switch.
You have more than one interface (in your case the "active" interfaces on CAP02 are all the vlan interfaces and bridgeLocal with pvid 99 (which has ip address 192.168.99.12/24 assigned. Note that there is currently no way to get to the bridge interface itself from one of the bridge ports, because of frame-types=admit-only-vlan-tagged), and vlan 99 also has a vlan interface (so the link between the virtual switch and the CPU will have vlan 99 tagged (dynamically due to the vlan interface for vlan 99), but it has no ip address associated with it. How are you connecting to the CAP02?
If you are using winbox, you may be connecting to one of the vlan interfaces.
What I expected is more like the configuration on CAP01, where there is a single vlan interface.
I would also either leave the bridge pvid 99, or change it to something that isn't used anywhere else. Since you have frametypes blocking untagged frames, the pvid isn't really significant, but having it the same as what is used by a vlan interface is at least confusing. With the version of ROS you are using, the bridge will be configured as a tagged member of the vlan for which a vlan interface exists.
i.e. if you use the commands:
/interface/bridge/print you will see that the pvid associated with the bridge is 99 and frame-types
/interface/bridge/port/print you will see configurations of the ether ports in the bridge
/interace/bridge/vlan/print you will see vlan table and how the "virtual switch" will communicate with the CPU over the virtual internal link.
Do see RouterOS bridge mysteries explained and Vlan-aware bridge mysteries threads for more info about the "bridge" in ROS (which is based on linux).