SSESS Cookie (Session ID) is being changed when loading images that don't exist
I finally found out what was the exact problem in my case:


I had varnish which per default, strips all cookies from the request to images. So when an image style is called, the request won't get any cookies and is thus an anonymous request.
The image is not present, so PHP is called to generate it.
A custom module invokes code that includes private tempstore (via Event listener but could also be hook_init() or something similar). 
The SessionStorage is not aware that there was already a session because varnish stripped the cookie away. It therefore just started a new session (with the same cookie name but with another value). That was the return cookie.


At least it's solved now. An alternate way could also be that varnish could also filter all returned cookies, but this has to be configured / coded in the varnish config.