There are several ways that sessions can be lost. Some of them are in your control some are not.
The first thing to consider is that session state requires that cfid & cftoken OR a jsessionid values are returned by a client for every request that should belong to an earlier session state. These values are usually returned in cookies but can sometimes applications are configured to pass then through get aka url variables. If anything prevents these variables from being returned ColdFusion will not know what session a request belongs to and just create a new one for the request.
Common things can that mess with cookies that our out of your control, are browsers with cookies disables. Virus|Anti-spam|spyware tools that strip cookies from requests or old or badly functioning proxy servers that strips OR caches cookies are three that I have seen in times past.
You should do every thing in your power to make sure there are not odd paths through your applications that maybe unintentionally eliminating state data. But that can only be done by analyzing your application and trapping these errors and determining their causes.