The question was answered in
https://github.com/ava-labs/gecko/pull/59#discussion_r406597250
> In general, the lock needs to be held whenever a VM function is called
> by the consensus engine. Depending on the locking specified in
> CreateHandlers locks may be held when an RPC is called as well.
> For the AVM specifically, the lock is assumed to be held both when an
> RPC is called and when any function is called, except for the ws API.