I'd check how the users are disconnecting their sessions.
If they don't gracefully disconnect (unplug their cable) the ASA may keep that session up for the duration of the idle-timeout.
The default-idle timeout is 30 minutes. You may choose to lower that value in the respective group-policy.
HTH,
Rob