Hi Von,
The answers to these questions depend a lot on the data access patterns in the application. However, I can provide some general guidelines.
1. If the peak CPU load gets to around 25-50% I would definitely consider moving the database to a separate machine. Also, if you have long running or memory intensive queries, that would motivate this separation as well.
2&3. For the typical line-of-business application, I would ballpark that each DevForce app server can handle thousands of concurrent users, if not more. The client-side cache enables DevForce to scale quite dramatically. As you scale into the tens of thousands of concurrent users or need redundant server infrastructure, then you can look at clustering multiple app servers together.
When you have multiple DevForce application servers in a cluster, you should set the sessionEncryptionKey in the config file to be the same on all servers. This enables user session transfer between servers and allows different server to pick up a client request if the "original" server goes down or is too busy. More information on setting the config file is here: