Hi Nick,
The two places I can think of are the ICM log (should tell you if a certificate) is getting thrown out from the web tier, or at the work process level itself (dev_w* in the work directory).
The problem with finding these, is that if you're load balanced, it takes time to determine which server you're going to and which logs to look at.
I've had some similar weirdness with tokens, and most of the time it ended up in session management. Perhaps look at ICM timeouts throughout the landscape, and try to make them consistent in any step of the traffic path (i.e. load balancer, web dispatcher, backend ICM timeouts). Some of the time you'll hit where one of these invalidates your session, even though on the backend the session is still good).
Also, perhaps take heed of how the user closes the browser, if they've been on it recently, etc. Sometimes the old vs. new sessions can bang into one another, causing some issues.
Hope this helps a little,
MM