Someone may wonder, how could I know how many sessions I have, or how large they are. I'll point out that both the CF Performance Monitoring Toolkit (PMT, for CF2021 and 2018, Std and Enterprise) tracks that, as does the older CF Server Monitor (for CF2016 and earlier, Enterprise only), as does also FusionReactor.
There are also the undocumented CF java objects, one of which can show a session count.
I did a blog post pointing out more on that, including an app created in 2009 by Mark Lynch, ServerStats, which you can still get. I've not tested it in a few years.
Now, as for tracking the memory USED per session, or in aggregate, that's another beast entirely. The old CF Server Monitor offered a "memory tracking" feature--which when most enabled it, it would kill their CF instance, so not a good idea. The new PMT offers a more intelligent way to control such tracking (not enabled by default), which you may want to look into. FR does not track the size of each or all sessions (because again, doing that can be challenging.)
All that said, tracking simply the session COUNT alone (per app or in total) can often be useful enough to spot problems. I've helped people see the count was shockingly large (tens or even hundreds of THOUSANDS of active sessions), and those are often caused by bots. That's again an entirely different topic with its own solutions, as I discussed years ago
in this post. While it's 16 years old, the concepts still apply, and I really should reprise it with new info/tools.
Anyway, hope that's helpful.