That would explain your issue.
You will need to determine who/what is calling the API and why they are not calling the API in a way that accurately reflects the user's state. Then we'll need to troubleshoot that.
192.168.0.21 sound familiar? who is that?
See top of thread.