Turns out this problem came back. But this time I think it's fixed. The key was setting the orb iiop listener's network address. The default is 0.0.0.0, which works for most clients, but we particularly had problems with people coming in on VPN and possibly different subnets. Once we set the address to the dns name of the machine, it works MUCH better. No lockups for a whole day.
Count this is as an advertisement for glassfish support. We bought it a couple weeks ago and they gave us the clue we needed to fix the problem.
[Message sent by forum member 'culli' (jim.cullison_at_gmail.com)]
http://forums.java.net/jive/thread.jspa?messageID=370921