After every page request the RequestCycle asks the RequestLogger (if any) to write the time taken etc to the logger (using the SessionData of the current Session). If none exists then a new SessionData is created (RequestLogger line 250). However when a user logs out the SessionData is destroyed, but the page still has to detach and thus creates a new SessionData entity.
When we lookup the live sessions and peak sessions from RequestLogger, the two numbers are (nearly) always the same. Which is wrong when all users have logged out or closed their browser (no difference there).