It looks like these are indeed not found, so filtering against locked pages and deleting trailing .lock files at diruri() level anyway should help if file manipulation is disallowed.
Also, on testing against this, I realized the checks were running without an impersonation first, breaking the isLocked()function on server script level, where no user is set by default (except for the locks that wouldn’t be recognized anyway).
[Edit:] also of note: some locks were removed via the isLocked() check, possibly due to missing users.