Issues with Ring Spot and Floodlight cameras on Ubiquiti VLAN

I'm slowly losing the plot with this issue, and Ring tech support haven't been able to shed much light on this - so i'm hoping someone here can! I have a home network using Ubiquiti PoE switches and Ubiquiti AC-HD/Mesh and AC6 Access points. All devices are routed through an OPnSense firewall over a 1150Mb Virgin Media Internet connection (VM Router in modem only mode) I have run a mix of Spotlight and Floodlight Cameras for about 4 years - generally with few issues (apart from poor Wifi reception, even though they are within 2m line of sight of access points!) I've added another couple of Floodlight Plus and a Floodlight Pro Camera, these are added for my wired doorbell Pro 2, multiple Chime and Chime Pro (1st and 2nd Gen) and a Ring Alarm system. These have all been run on a separate SSID which was restricted by MAC address to access the network. They obtained an IP address on the main LAN and stayed on the same VLAN. I recently decided I wanted to isolate the IoT and Security devices from the main network; so I have created a separate VLAN for the Security cameras, with the firewall issuing separate IP Addresses based on reservations, and assigned the SSID already in place to the VLAN. the firewall and access point ports are all tagged for the Security VLAN, and all devices connect and pickup their respective IP addresses fine. All good - well almost. I've got a restrictive Firewall policy on the security network (for obvious reasons), so apart from the specific ports needed from Ring comms, connection to internet based NTP and DNS servers, and 80/443 (ipv4), all other traffic is blocked, as well as being blocked from any other VLAN. I found that a couple of tweaks were needed to get things to work properly, namely the UDP port range needed to be opened right upto 65535 as devices were trying and failing to get through. but other than that, no errors. Despite this, 3 or 4 of the cameras are repeatedly dropping live view - and i only find out when i get a motion alert from the device and try to view it! then i check the history and find it's not been uploading video for 24-48 hours, even though the camera is still working otherwise. in some cases, a camera will go completely offline and need a hard reset, most other occasions and reboot through the app brings it back up again....until another drops. they are on the same SSID they have always been, the only difference being it is now getting a new IP and on a VLAN. the cameras having issues are on multiple different access points and there are others on them without problems - they are different models and revisions and others are working fine! Can anyone offer any advice? I've tried enabling mDNS reflectors, allowing Multicast, changing all the multicast settings, and all that did was show a shedload of extra traffic from my homebridge server on the security vlan!