Classic ASP enabled Windows Authentication but Request.ServerVariables(“LOGON_USER”) sometimes return wrong username
It turns out the culprit was Apache HTTP Rewrite, because from observation of the IIS logs, the client IP address is always the same, in this case the Apache Server. It looks like it either has some caching issue or it's just not compatible with IIS's windows authentication. Either way, by removing this, the issue is no longer encountered.