I am intrigued as to why running a sonar discovery works, as this would imply that Interface Index values are changing, but unless you only have 1 device source within NTA I would be surprised if this is happening across multiple devices at the same time.
Things to review:
1. What does the Netflow Events resource show - are there references to receiving flow data on an unmonitored interface? If so you need to inestigate if Interface Index values on your device sources are changing (if they are)
2. Do any of the Orion services stop running
3. What do the Business Layer and NTA logs show
This may be a support case to raise as that may be a quicker resolution to a situation that should not be occuring.