I would highly suggest that you use a tool like JMeter to simulate your production load on a staging server so you can monitor what is going on.
Also, what OOM errors are you getting? Perm gen or heap? You should be able to find them in your “out” log.
You should observe what memory GC patterns look like over time with your app. Is heap space being reclaimed, or slowly leaking?
You can turn off session variables in Application.cfc: THIS.SessionManagement = false;
Unless you are having the client return cookies or URL variables to reuse session from one request to the next, I would say turn it off. REST in general is supposed to be stateless.
Thanks!
~Brad
ColdBox Platform Evangelist
Ortus Solutions, Corp
E-mail: brad@coldbox.org
ColdBox Platform: http://www.coldbox.org
Blog: http://www.codersrevolution.com