Thank you for posting that. It's pretty much exactly what I had written in the first draft of my previous post but because I wasn't 100% sure I removed it. I hadn't had enough time to research it and find supporting information but I had my suspicions. All I came across last night was Apple's post on the matter
which really doesn't say very much about how it works. It implies that the private MAC address stays the same for a particular wi-fi network but this isn't actually the case at all.
What Apple means is that it stays the same when associated with a particular BSSID
- until it doesn't stay the same. If you have one router with dual band, it has two BSSIDs; one for 2.4GHz and 5GHz. If you add just one dual-band extender to the setup, that's another two BSSIDs so you already have four separate device identities which the iPhone/iPad creates to cope with these four BSSIDs.
Even with four separate identities created, the Apple device may drop these and generate new ones at an unspecified time in the future. That may be as often as several times a day according to Fing
which posts an interesting table comparing Apple's MAC anonymizing to that in Android 10 and beyond.
Once the BT router's device list gets beyond a certain size, it starts behaving unpredictably. It doesn't fail to give an IP address every time, only some of the time. This happens with wired devices that have a fixed MAC address as well as wi-fi clients, Apple or not. Disabling private wi-fi addresses within iOS/iPadOS settings will help to slow the rate at which the router's device list gets too large.