After 11 users logged into the GUI and surfed around a bit, the used heap shot up by about 400 MB. Analysis of the heap dump showed that the culprits were very fat org.ajax4jsf.util.LRUMaps inside org.ajax4jsf.application.AjaxStateHolders inside Tomcat Sessions. Googling for these misbehaving classes brought me to https://jira.jboss.org/jira/browse/RF-3878. There is a workaround described in the forum post linked off this issue which entails adding the following context params to web.xml:

<context-param>
 <description>
 </description>
 <param-name>com.sun.faces.numberOfViewsInSession</param-name>
 <param-value>1</param-value>
 </context-param>
 <context-param>
 <description>
 </description>
 <param-name>com.sun.faces.numberOfLogicalViews</param-name>
 <param-value>1</param-value>
</context-param>

We should test out this workaround this asap.

Note, RF-3878 is closed and says it was fixed in RF 3.3.0, but it doesn't describe what the fix was. We should ping the RF team for more details...