Here is some more information on this issue. This is happening only on AJAX call and only for a child portal. Here is the scenario.
I have two portals one with URL abc.com (let's say portalid 0) and the other with URL abc.com/test.(portalid 1). If the second portal with ID 1 is created as a child portal (subfolder called test under the main portal with just one file Default.aspx), then on the second portal on Page load the value of variable [PORTALID,System] is 1 but it is 0 for AJAX call.
However if I create the second portal as a virtual directory called "test" under the main web site that points to "abc.com", then on the second portal, the variable [PORTALID,System] returns 1 on both Page load and AJAX calls. This seems like a bug in OWS where it is dropping the part after the "/" in the child portal URL when making an AJAX call and hence finding the portalid of the parent.
Can you please confirm if you can recreate it and if this can be resolved quickly as child portals are part of Core DNN functionality. I understand that saving the value in Session on Page Load is a workaround but that does not address the main issue where incorrect portalID is returned on AJAX call.