IIRC the MCP23017 is quite buggy, and there are a number of corner cases that Microchip support are aware of and have confirmed which haven't made it into the published errata.
Googling: +"MCP23017" forum errata will find a number of topics on various forums mentioning them, and if you dig through the dross, you will have some idea of the wide range of ways it can foul up.
I would suggest adding code to read back and confirm the device configuration as frequently as you can without compromising the intended function, logging all I2C transactions to a ring buffer and if an unexpected configuration change is detected, dumping the ring buffer to a timestamped log file. Then, as a patch on the problem automatically restore a valid configuration. Its not a fix, but it will give you ammunition when you contact Microchip support. If you've go the kit to do it, also log the Vdd supply. You'll need a DSO that supports one-shot post-trigger with logging or a fast datalogger. Trigger it with aspare Pi I/O pin.