One explanation is that, rather than being logged out of the site, your users are being moved from a site they are logged into to one that they aren't logged into. If your site is served via
https://www.example.org, you might see users "suddenly be not logged in" when they visit any of the following:
If your CMS site isn't configured to "lock in" a specific canonical URL (including protocol and hostname), CiviCRM may bounce people from another URL which they are logged into over to the URL CiviCRM thinks is "correct" (per CiviCRM's
civicrm.settings.php). When this happens, the user experience is that they get logged out (but they will then be mysteriously logged back in if they visit the URL they were logged in on before).
Drupal isn't fussy about having a canonical URL, but CiviCRM is, and it's good practice anyway.
If this is the behaviour you're seeing, your best bet is to configure your CMS / webserver /
.htaccess to enforce a canonical URL (single hostname and protocol), so that all visitors to alternate URLs are immediately moved over to the preferred / canonical base URL.