Ev.CAUSE_NORMAL (i.e. zero) would be the right value I believe for a normal Established event on a point to point call.  The scenarios where a different value are returned are the slightly unusual ones:
 
CAUSE_ALTERNATE
public static final int CAUSE_ALTERNATE
Cause code indicating that the call was put on hold and another retrieved
in an atomic operation, typically on single line telephones.
 
CAUSE_BUSY
public static final int CAUSE_BUSY
Cause code indicating that the call encountered a busy endpoint.
 
CAUSE_CALL_BACK
public static final int CAUSE_CALL_BACK
Cause code indicating the event is related to the callback feature.
 
CAUSE_CALL_NOT_ANSWERED
public static final int CAUSE_CALL_NOT_ANSWERED
Cause code indicating that the call was not answered before a timer
elapsed.
 
CAUSE_CALL_PICKUP
public static final int CAUSE_CALL_PICKUP
Cause code indicating that the call was redirected by the call pickup
feature.
 
CAUSE_CONFERENCE
public static final int CAUSE_CONFERENCE
Cause code indicating the event is related to the conference feature.
 
CAUSE_DO_NOT_DISTURB
public static final int CAUSE_DO_NOT_DISTURB
Cause code indicating the event is related to the do not disturb feature.
 
CAUSE_PARK
public static final int CAUSE_PARK
Cause code indicating the event is related to the park feature.
 
CAUSE_REDIRECTED
public static final int CAUSE_REDIRECTED
Cause code indicating the event is related to the redirect feature.
 
CAUSE_REORDER_TONE
public static final int CAUSE_REORDER_TONE
Cause code indicating that the call encountered a reorder tone.
 
CAUSE_TRANSFER
public static final int CAUSE_TRANSFER
Cause code indicating the event is related to the transfer feature.
 
CAUSE_TRUNKS_BUSY
public static final int CAUSE_TRUNKS_BUSY
Cause code indicating that the call encountered the "all trunks busy"
condition.
 
CAUSE_UNHOLD
public static final int CAUSE_UNHOLD
Cause code indicating the event is related to the unhold feature.</dd><dd>
If you still get zero even for some of these scenarios, if may be helpful to get some JTAPI logs (detailed level, all types) capturing the scenario and attach here.