Is it possible that your original assumption that:
"...a user doesn't access multiple pages simultaneously"
is incorrect? I could imagine a scenario where a single user
enters a lock named "session#session.CFToken#", which makes a long
slow call to the database. If that user gets fed up waiting, and
hits stop/refresh in their browser, it is possible that their
original request thread is still being processed, so the second
request thread which again uses the lock name
"session#session.CFToken#", waits more than 10 seconds for the
first lock to "free up", and then throws an error.
Is there any way you can dig into your web server logs to see
if this is indeed the behavior that is taking place around the time
that these lock timeout errors occcur?