Yes, a new process is spawned every time a CGI request is made. There is no direct connection between this fact and the need, if any, to lock files. File locking is a design decision that you'd make in order to try to protect file data if there is a strong possibility that more than one process might update a file simultaneously. The fact that the process might be called via CGI or not doesn't really enter into it.