1) The server gets a connection request from a malicious client which is not allowed to connect to Oracle, in which case the ORA-03136 error is the correct behavior. You can get the client address for which the error was thrown via sqlnet log file.
2) The server receives a valid client connection request but the client takes a long time to authenticate the request, more than the default 60 seconds.
3) The server is heavily loaded or more of RAM usage due to which it cannot finish the client logon within the timeout specified.
Oracle DB depends upon OS for all networking activity.
Oracle DB is the victim; not the culprit.
Root cause and fix are EXTERNAL to the DB.
Oracle is just reporting the reality it experiences.
You need to find & fix the buggy client that is mis-behaving.
How complicated is your network topology? Do you have clients competing for network resources with some heavy user like video? A switch that sometimes gets goofy port assignments? An NFS mount that hogs the wire for a file transfer?