You've stated you're interested in considering both collisions generated by "proper" means and attacks which involve maliciously generating GUIDs improperly. The answers to these two situations are extraordinarily different.
If all GUIDs that enter your system are generated by proper means (i.e. generated according to RFC 4122, then you can expect them all to be unique. GUIDs/UUIDs were designed from the start to provide the specific guarantee. A GUID/UUID generated anywhere will be unique from all other GUID/UUIDs without requiring any centralized authority. There are Oracle servers which generate millions of UUIDs per second in giant distributed databases without collisions. GUID/UUIDs were built for this.
If you are worried about malicious users improperly crafting GUIDs/UUIDs, you do have some concern. From this answer regarding UUIDs:
GUIDs generated by calling other people's GUID generation functions are still not suitable for use as unguessable auth tokens though, because that's not the purpose of the GUID generation function - you're merely exploiting a side effect.
That answer hit the nail on the head. GUIDs/UUIDs were never designed to be unguessable. They were designed to be unique. If the method you use to generate those GUIDs/UUIDs provides unguessability, that is a side effect of the process. You would need to investigate how your particular generator works.
As you have noticed, v1 GUIDs are particularly guessable. Their uniqueness depends entirely on a MAC address and a timestamp with 100ns increments. This is comparatively easy to spoof. If you can narrow down the time where a session was generated to, say 1/10th of a second, there's only 1,000,000 possible values. The only other protection you have is the clock-sequence field, which is not intended to be unguessable, so it is likely to remain the same between reboots of a computer.
v4, on the other hand, is almost completely defined by a 122 bit random number. These are highly unguessable, as long as you can trust the underlying random number generator. However, remember that you're reliant on a side-effect of the process here. There's no guarantees to the random number's quality because that isn't required to generate unique values -- its only required for unguessability.
As such, if you depend on the randomness of your session IDs as a security feature, you should generate them yourself, using a cryptographic generator you trust. There's nothing wrong with using the GUID format for these numbers. They'll still have more than enough entropy to deal with mere session keys. The trick is that you shouldn't trust the built in GUID generators to deliver guarantees that are not explicitly part of the purpose of GUID generation.