I had another case of that. Visiting users would have their phone logout at the 1 hour mark.
In the settings file, you should only ever put core SMs, not BSMs. BSMs only learn about users that are assigned to that BSM in their SM profile.
So, when a user from site 1 went to login their phone at site 2, it got PPM information to register to that phones CM1/2/BSM, but the settings file had the local BSM in it and the phone would send a register periodically to that BSM. Because the settings file pointed to the BSM at that site and because the user's profile wasn't provisioned on that site, the register got a 404 and got logged out.
Moral of the story for me was "never put 3rd point of registration in a settings file, let PPM do it. It persists through reboots on the phone"
Maybe you can enable SNMP on the phone and walk it - it usually provides the list of parameters the phone is using - or, go in the SIP proxy part of the craft menu and see what it's doing for the hour it's up. Usually the 9600 phone's 'expires' timer is 3600, so it should re-register after 30 mins - so it's likely not something around refreshing registrations if you only see the problem around an hour in.