We recently encountered some OOM issues on a reasonably loaded router-vm. This particular instance was given adequate memory / cpu resources and was handling a production load for a decent amount of time. We currently believe that the root-cause was a hard to trigger bug in the 2.6.32-5-686 debian kernel running on the VM, which caused a kernel slab exhaustion and triggered the oom-killer.
This seems like something which might be fixed in the 3.2/wheezy kernel shipped with 4.2 - so we're planning an upgrade for the affected virtual machines. I've created https://issues.apache.org/jira/browse/CLOUDSTACK-4623 in an attempt to document the issue for future reference.