Move state out of your application servers:
Session data: Don't store in server memory. Use Redis or database-backed sessions. Now any server can handle any user.
File uploads: Don't store locally. Stream directly to S3 or object storage.
Caches: Use distributed cache (Redis) instead of local memory cache.
Job state: Store in database or message queue, not in worker memory.
The test: If you kill any application server, does anything break? If yes, you have hidden state. Find it and externalize it.