Spa504g crashes - registration/drop issue

Question

I have had an intermittent issue where users attempt to answer a  call, but the device(spa504g) freezes and the lcd gets stuck  "Answering". The  phone becomes unresponsive to any button presses; even  after considerable  patience. The call is eventually dropped, and if we're lucky the customer calls back. The only solution is to unplug the power  and repower the  device.
On the server side, the phone often remains registered  for sometime even  showing that it is still on a call. I think after  about 15 minutes the  registration drops. So if I attempt to repower the  phone before it  unregisters, it will seem to register fine but will  not actually ring on  any inbound calls. Most of the time I've resorted  to restarting services on the server which effectively brings the system  down, even if only for a minute.
I'm using 3cx phone system. Our server is collocated so all extensions are remote. Aside from this, we have no other issues
We have 5 end points at this location all SPA504g with  7.5.4 firmware. We have low call volume and I'm usually the first guy  to take calls 90% of the time. But I have swapped out phones and confirm  that it has happened on more than one device, even on previous  firmwares.
I can't reproduce the issue. It has happened about 5  times this week, but hadn't happened in over a couple of months prior to  this week.
I have experienced the issue ever since we went live with the system. So basically since everything was new out of the box.
I have created a support ticket with 3cx, providing syslogs for the phones, logs from the phone system, and wireshark pcap on the server. They say there is no problem on the server and that it is probably a phone/networking issue.

Answer 1

@Christie:  In our testing, we just turned off STUN in the phone's web GUI and turned off DHCP option 66 so the phone did not auto reprovision itself. I may have also manually edited the provisioing file for that particular phone we were testing on, I don't remember. But, I believe simply changing it to 'No' in the template should be all you need. I don't know about it changing those other things to be honest.  However, my client is back to having it turned 'On' (the default provisioning template settings) and we're using the test firmware that Cisco provided me a few days ago, and so far, no lock ups!
@Robbie:  The 'PBX Delivers Audio' setting was something different; something I changed to allow extension-to-extension calls to pass audio at the remote site. Christie is talking about the disabling of STUN on the phones. I've not had any complaints from the users regarding blind transfers and they don't use headsets, so I can't comment on those things. Also, for our tenants, the server is in one location (the data center) and ALL of their phones are in another location (their office), so I also cannot comment on multi-location setups as you mentioned in your last sentance.  Good to know for future refecence though!
@Christie:  Those changes you mentioned in your 5:24pm post seem to be spot on with what I did during my testing.  I've now got STUN re-enabled and am using the test firmware Cisco has provided me.  Not sure if I really need STUN, but I figure the least amount of changes from the default 3CX provisioning template, the better.
@Robbie:  Ironic for you, but not for me.  All of the lock-up occurences my users have reported have been with OUTBOUND calls (with both internal-to-internal AND internal-to-external calls).  Actually, I take that back; I had a user report the other day that he was trying to do a Call-Pickup (answering another ringing extension) using the BLF button on his phone and then his phone locked up - technically not an incoming call to HIS extension. Hopefully it's all related and this new firmware will fix that too.
I'll be out of the country with no access to internet/email for two weeks. I hope to have no reports of lock-ups from the cusdtomer while I'm gone.  Assuming this is the case, I will report to Cisco that the test firmware appeared to fix the problem and I assume they will release it to the general public.
Appreciate the input from everyone!  I'm hopeful we are close to a resolution!