There is lots of random bot traffic which hits 404s and when 404s are forwarded to /error/index.php for handling, which then creates a moodle session which is never used again.

If a real user legitimately ends up on the error page then it is nice that the error page knows who they are and prints the correct page header etc, but in most cases if it's a bot and they are not logged in then this should not create a new session when they will never come back and it just clogs up the session store.

The only legitimate reason you need a session on this page is if you are a real human and you also want to fill out the form on the error page to site support because forms need a sesskey. But in most cases that form doesn't even show with default config.

In 3.10 in MDL-56041  I cleaned up the way error pages could be used to send a message to the site support, but then in MDL-73608 in 4.0 a much nicer way was added in parallel and I think should have completely replaced the error page contact form.  They are both only available under certain conditions, but those conditions mostly overlap, and so in most cases you get neither form, or only the new better one, or when fully setup you would get both forms which is redundant and confusing.

Given that there are two competing contact forms, and the new one is obviously superior I propose just removing the old one, and then we can safely mark the error pages as not needing a session lock, or a session at all if you are anon.