A look at server side tcpdump
tcpdump -i enp0s25 -w 8021x.pcap " udp port 1812"
Showed that the last packet had marked the "more fragments flag" but never sent more fragments.
Changing the fragment_size in the config file for wpa_supplicant fixed my issue.
# fragment_size: Maximum EAP fragment size in bytes (default 1398).
# This value limits the fragment size for EAP methods that support
# fragmentation (e.g., EAP-TLS and EAP-PEAP). This value should be set
# small enough to make the EAP messages fit in MTU of the network
# interface used for EAPOL. The default value is suitable for most
# cases.
