CF 2016 has reached it's official end of life. Better to migrate the application to CF 2018 or CF 2021.
That being said, check the domain of the cookie that is being set in the browser, check if session management and setclientcookies are enabled or not, if using J2EE session management check sessioncookie same site settings.