You state your CMAC is 128 bits, so in general you don't need a passphrase with more than 128-bits of entropy. However, if you choose a 16 character password (without picking the bytes completely randomly), the entropy isn't 128-bits, it's typically much less. E.g., if you chose randomly from 95 printable ASCII characters, you'd have about 105 bits of entropy (log2(95^16) ~ 105) which is about 8 million times weaker than a 128-bit entropy passphrase. If you didn't choose randomly, but say concatenated English words, the entropy would be much smaller; e.g., meaningful English has an entropy of about 2.6 bits per character (16*2.6 ~ 42 bits), which would be quite feasible to be broken in offline attacks.
If you want to remember a meaningful English phrase as your passphrase, it should probably be about 50 characters long (128 bits/2.6(bit/char) ~ 49.2). Or if you chose a diceware passphrase randomly from a dictionary with 6^5 = 7776 words in it (12.9 bits/word), then you need about 10 words to get to 128 bits.
So, to summarize there is an upper limit to security when using a passphrase. E.g., there's no use having a 20 word diceware passphrase with a 128-bit CMAC (the entropy of the MAC maxes out at 128 bits); the 20-word passphrase won't be more secure than a 10-word one, but a 10 word diceware passphrase will be significantly more secure than a 3 word one (that say has 16 characters in it) with an entropy of about 39 bits.
EDIT: The primary key used in WPA2-PSK is the PMK (pairwise-master-key). This is derived from the pre-shared password and the name of the access point. The PMK is 256-bit (32 byte) and calculated via
PMK = PBKDF2(HMAC-SHA1, preshared_password, salt=access_point_name, rounds=4096) (where PBKDF2 is password based key-derivation function 2, which in this case involves 4096 rounds of HMAC-SHA1).
If you somehow found a different password that generates the same PMK for an access point, you can connect to the access point, eavesdrop, and tamper with messages.
That said in WPA2 you also derive a transient key (PTK) from the PMK and random nonces sent over during the four-way handshake. The PTK is 512-bits, parts of which are used for different purposes, but your traffic within a session is encrypted with a 128-bit transient key. (If you find a encryption key part of the transient key you could decrypt traffic within one session, but that's it -- you wouldn't be able to sign traffic to tamper with it or create new sessions).