Simple REST - API. The underlying connection was closed. An unexpected error occurred during reception

Question

I have a problem with IIS Website. At the back of the website I have an API.

[LogApiRequest]
public class XController : ApiController

Very rarely like one in several thousand calls, the client receives an error:

w System.Net.WebException: The underlying connection was closed. An unexpected error occurred during reception. w System.IO.IOException: An established connection was aborted by the software in your host machine. w System.Net.Sockets.SocketException: An established connection was aborted by the software in your host machine
w System.Net.Sockets.Socket.Receive(Byte[] buffer, Int32 offset, Int32 size, SocketFlags socketFlags)
w System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
w System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
w System.Net.PooledStream.Read(Byte[] buffer, Int32 offset, Int32 size)
w System.Net.Connection.SyncRead(HttpWebRequest request, Boolean userRetrievedStream, Boolean probeRead) w System.Net.HttpWebRequest.GetResponse()

I added logging:

   public class LogApiRequestAttribute : System.Web.Http.Filters.ActionFilterAttribute
    {
        public override void OnActionExecuted(HttpActionExecutedContext actionExecutedContext)
        {
            base.OnActionExecuted(actionExecutedContext);
            //log here
        }

        public override void OnActionExecuting(HttpActionContext actionContext)
        {
            base.OnActionExecuting(actionContext);
            //log here 
        }
    }

Checking time:

• 2023-09-28 15:42:20.383 Call from client
• 2023-09-28 15:42:20.380 IIS Executing
• 2023-09-28 15:42:35.303 Error in client (connection was closed)
• 2023-09-28 15:42:37.540 IIS Executed

So connection was closed 2 sec before OnActionExecuted.

How can I check why this is happening?

Additional info: There was no attempt by other users to invoke the method at this time. The client and server are on the same physical server, but on two different virtual machines (1GB connection)