STM32 reset not work
As I said in my comment, I'm not convinced that the true "failure mode" has been defined - "dead" does not appear correct.

However I have found one error in the design, from the excerpt of the schematic supplied - \$\small V_{BAT}\$ is not connected. I'm checking the docs now, but I believe that is required. From memory, failure to reset properly is one possible side-effect. More to follow...



Update: From the STM32F107 reference manual, they say it is "recommended" that \$\small V_{BAT}\$ is connected to \$\small V_{DD}\$ (and decoupled). I seem to remember rare reset-related issues without this connection, but I'm away from my notes so don't have more details.



The same advice is given in Application Note AN2586 - Getting started with STM32F10xxx hardware development:



I'm not convinced about the analog filter in the schematic, as Marko has mentioned and, as Lorenzo has said, not being able to reproduce your problem in the lab is telling you something. Something is different (e.g. power quality, user behaviour, EMI, shielding etc.) between your lab test procedure and/or your lab environment, and the environment where the units "fail" (in whatever way that "failure" is eventually defined).

One more thing: Your external components attached to nRST don't match the recommended configuration by ST (you've got an external pull-up resistor which they don't recommend). I am not saying that this is causing a problem - just that it may need further review.

However I have run out of time for now. Hope this info helps.