You should probably post some relevant snippets of your code, especially how (and where ie in what event, in the page lifecycle) you are getting and setting the object/variable from session state. Without seeing your code it is not easy to help.
Remember that for unauthenticated users the user guid probably would always be an empty guid so it would be the same for all unauthenticated sessions. You don't really need to "link" it to anything session is already unique per user/browser/machine in ASP.NET, or more correctly it is unique to a session id associated with a unique per session session cookie as I said before.
Best,
Joe