The session store is probably on the local web machines and the load balancer is not 'sticky' meaning that every HTTP request goes to one server or the other based on round robin. When the user logs in, the session is stored on machine A and then on the next request, he has a 50% chance of hitting machine B and having an unrecognized session and then the same 50% chance of failure every time.
Change the sessions to be database backed, or managed by the load balancer, or use sticky load balancing if the device supports it.