So, if miner got reject with "unknown-work" message, this means that local working set wasn't updated properly while pool's working set updated already. This could be caused by network problem, and can be resolved by manual expiry time decreasing. Try -E 30 option for cgminer/bfgminer.
Thanks a lot for posting your suggestions here, any knowledge sharing is highly appreciated. Maybe one more hint in case anyone runs into similar issues as I did:
I had ~4% to ~10% rejects on cgminer (a wild mixture of graphics cards on several systems). Setting expiry to 30 unfortunately didn't help. The reason turned out to be connected to the fact that the miners are on a relatively slow internet connection. After I disabled the stratum proxies and CPU miners on two of the systems, reducing network load, everything seems to be fine now
