I would think the switch port that the phone system is connected to should also be tagged for the VLAN. Consider: The phone system LAN2 address is used to control the operation of the IP phone using port 50000. This is what keeps the phone connected to the system. A loss of that connection will force a phone to reboot to reacquire that connection. Also, look at the time frame when this is occurring. From 8 to 10 AM is when everyone is getting to school, firing up their computers to check email, get lesson plans, etc. Lots of network traffic to impede the phone connections to the KSU.
I have another school using nearly 100 IP phones with a VLAN. The phone system LAN2, MBU and all phones are tagged in programming for the VLAN, and the VLAN is based on Iwatsu MAC numbers to disallow other devices- this issues doesn't occur at all.
You can use Tools>IP Configurator to program each IP phone if you know the IP address of the phone, or , you can open a browser at the phone IP and configure it that way. Using static IPs will remove the problem of someone plugging in something they shouldn't and 'stealing' an IP address that belongs to a phone. You have a K-12 environment, so it's a good bet this kind of thing has been going on for a while.
