These things can be very frustrating. My production system hums along 24x7 with almost no complaints from users but my production logs are always full of duplicate token errors. I don't believe it is possible to make them all go away.
The only way to know for sure what is happening is to record the HTTP headers of a failed logon and examine them. This is what I usually recommend. If you post them here, we can diagnose them for you.
The problem in a situation like yours is collecting them. If you can't repro and the user is remote, you may need them to repro for you and getting them to properly use a HTTP collection tool may be a challenge.
You might start by asking what browser they are using and if they have any settings in place that might disable cookies.
Also, you may run into issues on the target application if the issued cookie path is different from "/". If you have a path in there, that will be treated as case sensitive by the browser. Those types of errors are easy to repro but sometimes you may not see the exact URL the user is using on the target app and thus won't notice this type of thing.