It's unclear to me if you're talking about round-robin DNS load-balancing or if you're using a layer 7 load-balancer that's doing round-robin load-balancing of the HTTP sessions. It's also unclear if you're allowing clients to use HTTP/1.1 persistent connections to the application servers.
In short, DNS load-balancing shouldn't cause the behavor you're seeing. Layer 7 load-balancing certianly could, especially if you aren't allowing clients to keep persistent connections open to the application servers.
Some amount of 401 responses to client requests in an NTLM-over-HTTP environment are normal. The NTLM-over-HTTP handshake is as such:
- the client makes a request
- the server responds with a "401.2 Unauthorized" and a "WWW-Authenticate: NTLM" response header
- the client responds with another request with an "Authorization: NTLM" header and the initial NTLM authentication response
- the server responds with a "401.1 Unauthorized" and a "WWW-Authenticate: NTLM" response header that contains the NTLM challenge
- the client responde with another request with an "Authorization: NTLM" header and the NTLM response
- the server fulfills the client's request (i.e. they're authenticated)
You can get deeper background at http://www.innovation.ch/personal/ronald/ntlm.html (including byte-for-byte descriptions of the headers, etc).
NTLM-over-HTTP authentication authenticates each connection, so connection keepalives or HTTP/1.1 persistent sessions are required. If, hypothetically, you're not using persistent connections nad randomly bouncing client requests and responses to NTLM challenges between different IIS servers then you're going to have problems (and, frankly, I can't imagine it would even work).