We use several session variables but do not use application state. The session variable are mostly short string (less than 10 char) or Boolean values.
I think I have narrowed down the cause to an unmanaged dll (which is used for calling our address verification software). Running an address check several times in a row will always cause an OOM exception. This server is not live yet, so we had left the debug settings enabled. Setting <compilation debug="false"/> did not seem to have an effect, but setting <trace enabled="false" /> did seem to stop the error for now.
Another thing that did seem to work was calling GC.Collect() after each time an address was verified. I know this isn't a good practice, but can any harm come from doing this? Also, if running garbage collector can correct the issue, could it still be the unmanaged code causing it? (I thought GC only cleaned CLR memory, and that unmanaged code ran outside the CLR).
Thank you for your help. I will mark your post as an answer after my second question is cleared up (or if no one replies) since you pushed me in the right direction.