Hi Graham,
What you are seeing is not the norm, so to determine the cause it's helpful to understand what you are doing that is "not normal".
You indicate that this is an API type app (using NetWebPages) - which suggests that your client software is a program rather than a browser. It's possible your client program is not closing connections correctly?
One change I can see is that over the years the server timeout was turned off, so the server won't time-out idle client connections. You could set that back if you like (say to 2 minutes or whatever works for you.) I'm talking about connection timeouts here, not session timeouts (that's a completely different discussion, and does not appear to be in play.)
My gut is that your clients are not correctly closing the connections once they are done with the request. So either they should be fixed (to respect the HTTP protocol) or some proxy is between you and the clients and is not closing connections.
So either fix the clients, or set the server connection timeout.
cheers
Bruce