its caused by sessions.gc_maxliftime, and has been the bane of my life for getting on 2 years, until Al and I found it.
session.gc_maxlifetime
This value (default 1440 seconds (20 minutes)) defines how long an unused PHP session will be kept alive. For example: A user logs in, browses through your application or web site, for hours, for days. No problem. As long as the time between his clicks never exceed 1440 seconds.