Sounds like you are having problems with Apache::Session's locking system because the session object isn't being destroyed at the end of a request in some situation. It could be that you accidentally made a closure somewhere that holds the %state hash.

The shotgun solution is to simply stop using Apache::Session's locking. Change from Apache::Session::MySQL to Apache::Session::Flex or just change Apache::Session::MySQL itself and use the NullLocker instead of the MySQL locker. However, that might mask the larger problem which is that your session data doesn't get saved when the object doesn't get destroyed.