wIPS is basically  advanced approach to wireless threat detection and performance management. 
It combines network traffic analysis, network device and topology information, signature-based techniques, and anomaly detection to deliver highly accurate and complete wireless threat prevention. 
With a fully infrastructure-integrated solution, you can continually monitor wireless traffic on both the wired and wireless networks and use that network intelligence to analyze attacks from many sources to more accurately pinpoint and proactively prevent attacks rather than waiting until damage or exposure has occurred.

The regular local mode or FlexConnect mode access point is extended with a subset of Wireless Intrusion Prevention System (wIPS) capabilities. 
This feature enables you to deploy your access points to provide protection without needing a separate overlay network.

wIPS ELM has limited capability of detecting off-channel alarms. The access point periodically goes off-channel, and monitors the non-serving channels for a short duration, and triggers alarms if any attack is detected on the channel.

But the off-channel alarm detection is best effort and it takes longer time to detect attacks and trigger alarms, 
which might cause the ELM AP intermittently detect an alarm and clear it because it is not visible. Access points in any of the above modes can periodically send alarms based on the policy profile to the wIPS service through the controller.
The wIPS service stores and processes the alarms and generates SNMP traps.

and AP submode none is just to disable the wIPS on the AP.