And both of them have
Columns: 1
in its settings?
If true, It's quite strange. I'll try to reproduce it locally, but we have never met such an issue previously.
Could you insert following code into default.php (just after leading "<?php" tag, on the next line):
if (0 === (int) $this->params->get('num_columns')) file_put_contents(__FILE__ . '.log', $_SERVER['REQUEST_URI'] ."\nindex.php?" . http_build_query($_GET) . "\n\n\n", FILE_APPEND);
? (don't forget to backup original file before any changes)
It will log the URL of request (and parsed non-SEF URL) to the default.php.log file for every request that results in such an issue.
