Hello Adam
There may be several reasons for flapping to occur on backup cellular connections. Before we look at your config, keep in mind that some cellular companies will disconnect a cellular connection if the source IP addresses in the packets being sent on the 4G interface use a different source address than the one that has been negotiated with the provider. One way to solve this issue is to configure NAT so that all internal addresses will be translated to the IP address that is “allowed” by the provider.
Now looking at your config, I see you have a tracking object 434 that is tracking the reachability of the default route. If the default route goes down, you are also initiating an event manager applet that will clear the mobile router registration, which causes the “keepalives” from the router to the cellular connection to cease, essentially tearing down the connection. What this will do is any time the default route is not reachable, the cellular connection will be torn down, even if the default route in question at the time is your primary connection. So when it attempts to go to backup, the cellular connection, the very connection you want to use as a backup, will be torn down. Also, you are tracking both default route options that you installed whereas you should track only the primary (wired) one and have a higher administrative distance on the backup (cellular) default route.
My suggestion would be to review the following Cisco documentation on 4G configurations especially for backup.
https://www.cisco.com/c/dam/en/us/td/docs/routers/access/interfaces/software/deployment/guide/c07-731484-00-ngewan.pdf
Section 5.6 details the best practice for such configurations.
I hope this has been helpful!
Laz