ColdFusion skips the cflogin tag when login credentials are still valid and active. Since the tag runs in your case, it can only mean that ColdFusion had logged the user out. It would therefore seem that some of the AJAX requests were made after ColdFusion had logged the user out.
My guess is that blank, in other words, null, login credentials were passed in the requests following the logout. That would explain the NullPointerException.
If this is indeed true, then you have to modify your code. Include code to handle the case where the user is not logged in or where blank login credentials are being submitted.
You could use the onError event-handler in Application.cfc to provide information about errors. Something as basic as the following should do:
<cffunction name="onError">
<cfargument name="Exception" required="true">
<cfargument name="EventName" required="true">
<cfif NOT (arguments.EventName IS "onSessionEnd" OR arguments.EventName IS "onApplicationEnd")>
<cfdump var="#Arguments#" label="Error dump">
</cfif>
</cffunction>