I’ve never seen any behavior like this.
I’d take a really hard look at the custom middleware. I’d also be trying hard to recreate this in a development environment, which may need to have multiple browsers making concurrent requests.
I’d also be looking to identify any differences between your production and development environments. Without being able to recreate this in an environment that you can explore in, this is going to be difficult.
Unfortunately, I don’t have any other advice to give.