After a little more experimenting, it seems to be related to the “prevent cross-site tracking” option. I need to confirm 100%, but since turning it off, I’ve yet to be logged out. I wonder if it’s anything to do with how I have the subdomains setup?
I’ve switched my affected apps to a new domain, to see if that helps. The main difference is everything is on a unique sub domain, and there isn’t anything setting cookies on the domain root. I feel like I’m grasping at straws, but I can’t think of anything else I can try at this point.