We picked up quite a high number of ajax calls taking a significant amount of time in AcquireRequestState, in our travels we stumbled upon the session locking gem in ASP.Net
For anyone trying to rule out the session problem we ultimately faced above, but who still needs to rely on session values (so you can't just disable the session on the controller level) have a look at the following sessionstate provider:
https://github.com/aspnet/AspNetSessionState
Specifically make sure you pay attention to the following application setting:
<add key="aspnet:AllowConcurrentRequestsPerSession" value="[bool]"/>
You will need to upgrade to .Net Framework 4.6.2 but in our case it's a small price to pay.