It's not just network lag. There is a certain amount of latency involved in any HTTP request, even against a local server. Especially if you're using vanilla CGI, which has to load up the perl binary and compile your code before actually handling each request.

In my experience developing vanilla CGI against local servers, this can easily add up to a total delay of anywhere from a noticeable fraction of a second up to a couple of seconds between when you click and when the new page is rendered. If the user clicks multiple times before the new page is rendered, then the old page (with the old token value) will be submitted multiple times and there is nothing you can do on the server side to prevent that, only to detect when it happens and try to deal with it in a sane manner.

I have seen a few sites which try to address this on the client side by putting a little javascript on the submit button which disables it after it's clicked the first time, but I'm not aware of any other way to prevent multiple submits from occurring. Fortunately, in actual practice, it generally doesn't seem to be a terribly significant issue.