Resolution, for anyone who might benefit from my experience: the issue was relying on session state, which might or might not work in a load-balanced environment. The solution was to switch to the Firestore API for session management - which will cost more but seems to be working. Interim solutions using cookies or the project's own mysql database were problematic in different ways.

What's still aggravating is that GCP obviously changed something abruptly on the back end without notifying of the impending change.