Questions of this nature can be pretty-much categorically answered:   “it must be You!”

• “Plack is a plumber,” solely responsible for getting a request delivered from Apache to you, and a subsequent response delivered from you to Apache.   No smoking-gun here...
• Kelp, likewise, is a framework:   “generically” engineered to taking care of “whatever is ‘generic,’” so that you don’t have to.
• ... which leaves:   you.   Your application must be prepared to handle many (thousands of?) requests without “leaking.”   (It can, to a certain extent, “take the easy way out” by asking the PSGI manager to arrange for you to “commit hari-kiri” after so-many requests, but that is a crutch.)   You should always assume that you are responsible for closing all resources.