Coldfusion CFLock what type to use, application or session on an application obj

Question

So my issue is as follows, are application does a number of query calls for every page call. In order to remove these I decided to create an application obj or session obj. I decided on an application obj, as I didn't want to add the obj to session scope. Figured this could be bad with session scope to all the user's using up to much memory. On the other hand if I use application obj, will I not slow down performance with additional locks all over the place.

Now the application obj is setting session variables do I need an application lock or a session lock. From what I've been reading it seems that I don't even need a session lock. I don't see a race condition if this is a session obj, but a possible issue if it's an application obj.

**OnApplicationStart  
<cfset application.objSessionSecurity = createObject("component","common.cfc.SessionSecurity")>**


**later in the appliction.  
<cfset application.objSessionSecurity.setSessionSecurity(session.loginuser.persona_skey)>
<cfset application.objSessionSecurity.setSessionVaraibles()>**

Obj code.

<cffunction name="setSessionSecurity"  access="public" description="set session security privilages" >
    <cfargument name="personaSkey" required="true" type="numeric">        

    <cflock scope="session" timeout="30" type="EXCLUSIVE">
        <cfquery datasource="#request.dsn.otm#" name="allPrivs">
                SELECT pp.privilege_code
                FROM persona_privilege_vw pp
                WHERE pp.persona_skey = <cfqueryparam cfsqltype="cf_sql_numeric" value="#arguments.personaSkey#">
        </cfquery>

        <cfset session.PrivList = ValueArray(allPrivs.privilege_code)>        
    </cflock>
</cffunction>

So I guess this is two questions at the same time, should I use a sessionObj, or an application obj. ?

If an application Obj, do I still need the cflock around a session variable, and if so what type, application or session?

Thank you in advance. David.