The default redis acquire lock timeout is 120, what was the reasoning for raising it to 720?

The error log you are seeing is when there is another request currently open for that session and it is waiting for that session lock to close before it can get another one. This could be a long running session of starting a quiz, login, report running, course backup etc. Normally it happens if a user is completing a long task in one window/tab then tries to open another tab and keep working. The session is still locked to the first tab until it completes, so the second tab gets the "cannot obtain session lock". Another option instead of window/tabs are ajax requests.

With debugging enabled, is there any other information showed? In the access/error logs, can you determine which script they were trying to access when this happens. Try searching based on IP address in the logs to find out what the user was doing.

Moodle 3.9 has some good improvements in the session locking space as it allows some scripts to use read only sessions which won't hold the session lock. It has to be enabled in the config.php file but it might be worth trying to upgrade.

Do you have the MUC and Sessions in the same redis instance?

Have the app/db/redis servers been configured/tuned at all?

With properly tuned database, redis, php etc, 5-600 concurrent quizzes should be obtainable.