To answer my own question:
Network errors can cause cf8 to wait indefinitely for a
response from ldap
so that cf8 will hang when the number of threads waiting
exceeds the maximum set in the admin.
Save yourself from a meltdown by setting up an unresponsive
server alert that kills threads before this maximum is
reached.