Most common is a call going to the failover server. Are your voice mail ports in a separate partition that can't be directly reached by most users? If not, it's possible somebody is accidentally dialing one of the failover ports. To confirm, look at the application logs of the failover server around the time the failover occurred. You should see an event regarding an incoming call triggering the failover server to become active.