We've recently see one prod server showing high cpu usage, along with high dbpool usage at the same time.

Based on the threaddump analysis, this is related to Hibernate query invoked by user sending private message inside the Forms tool:

The related code are the Hibernate call inside TypeManagerImpl.java in common module, specifically the line of "return q.uniqueResult();"

public Type getType(final String authority, final String domain, final String keyword)
{
......
final HibernateCallback hcb = new HibernateCallback()
{
public Object doInHibernate(Session session) throws HibernateException, SQLException
{
Query q = session.getNamedQuery(FINDTYPEBYTUPLE);
q.setString(AUTHORITY, authority);
q.setString(DOMAIN, domain);
q.setString(KEYWORD, keyword);
q.setCacheable(cacheFindTypeByTuple);
---> return q.uniqueResult();
}
};
Type type = (Type) getHibernateTemplate().execute(hcb);
return type;
}

This might be a hibernate's issue instead of Sakai's.