This looks suspicious to me. Not something the kernel is made for.
Looking at the code, you could maybe remove the session from the request?
The best alternative seems to be to use a background task.

I am trying to implement stale http cache and automatic refresh in the background. I try if putting messages into queue with the new DeduplicateStamp helps. on the highly frequently used page, it could be several hundred users at the same time idk if that works great with that.

See https://symfony.com/blog/new-in-symfony-5-2-async-cache-recomputing and https://symfony.com/doc/current/cache.html#computing-cache-values-asynchronously ;)

I am now letting handling it over queue, was pain but finally works: https://github.com/shopware/shopware/pull/11739/files

nice to know async cache recomputing, but it think won't work for our complicated case. DeduplicateStamp seems broken does not work at all already existing issues there. symfony lock flock does never lock a resource, redis does lock, but never unlock. but cache stampede protection as hack for locking did worked 😂