RE: Reject reason

I am authenticating users based on Calling-Station-Id in addition to password.

All accepts and rejects are logged to the postauth table in my database.

Using what type of authentication? Are you really checking Calling-Station-Id during authenticate or are you checking it during authorize? What module are you using to validate it?