I've seen a very similar issue (ContextCSNs being newer on my consumers), and I believe it was fixed in OpenLDAP (2.4.26). Do the "CSN too old, ignoring" error messages spam endlessly in your consumer logs? As for your other questions. You only need a single accesslog, and the clocks on your consumer nodes do not need to be in synch with the Provider (in deltasync replication).
Wrong. Your clocks should *always* be tightly in sync. Particularly with the advent of delta-sync MMR in the next release.
--Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration