1. Is that 1 - 5 million people per day? or total users?

2. I haven't used CGI::Session yet so someone may have CGI::Session specific advice. However what I would do is give each row in my table a date field that holds the expiration date for the session. Then in a cron job, run a script that deletes all rows that have expired session dates.