Thanks @Ontapforrum !
1. no event logs related to this that we know of since it happens "whenever" and never often enough that we can react or know exactly when it occurred; but, we think we now have a way to capture the timestamp (w/in 30m) but the problem hasn't re-surfaced (the app team also made a change on their side).
2. yes and no -- only two clients and they were rebooted as part of the migration *before* this issue even surfaced (it surfaced days after the migration event); also, these two Linux hosts reboot weekly.
3. already done (see answer 2).