I have a feeling the device is using a dns cache and not trusting the dns response and asking for the resource at the last known ip.
(specifically what I would be looking for, since this device is not intended to be connected to the internet, would be any requests being asked by a connected device for a host other than the esp8266 access point on port 80 for a given list of urls. Although a blanket request->host() != WiFi.softAPIP() is probably sufficient to justify a redirect.
Problem is, I'm seeing the DNS server respond with the softAPIP to queries, but the device(s) are apparently ignoring them and going to a cached address)