It is rarely random. In order:

  1. Twelve hours have passed since they signed in. A member's sign-in lasts twelve hours from the moment they signed in, whatever they do in between. The session length and "Extend session while in use" settings in the OAuth configuration apply to admin sessions only. No setting changes a member's twelve hours. Remember me does not help a password member either: it only renews sessions that came from a single sign-on provider.
  2. They moved between hostnames. A link in an email points at the bare domain while the site runs on www, for example. Each hostname has its own sign-in.
  3. They were signed out from somewhere else. Changing the password, or ending a session from /my-account/current-activity, ends every other session of that member. If two people share an account, a password change on one device signs out the other.
  4. It only looks like a sign-out. A cached page shows the signed-out header (above). A page reached by a form posted from another site, such as a payment provider's return, arrives without cookies, because they are SameSite=Lax. A site inside another site's iframe cannot keep anyone signed in. Open /my-account in the same tab: if it opens, they are still signed in.

A submit refused with 403, "Missing or invalid CSRF token", also looks like a sign-out but is not one. The member is still signed in, and their PHP session was lost. Either way, what they typed is gone unless the page saved it: when a session runs out mid-form.