Profiing during a performance run has shown a lot of time spent during garbage collection, due to finalizer execution on JAXB UnmarshallerImpl objects. The UnmarshallerImpl.finalize() method executes ClassFactory.cleanCache() which in turn tries cleaning up a singleton ThreadLocal instance.
With a bit of investigation I've figured out that the finalizer there is basically a partial fix for JAXB RI integration issue with Tomcat.
In any case, the JAXB documentation suggest pooling Unmarshaller instances, ensuring that a given unmarshaller is not accessed by different threads at the same time (see https://javaee.github.io/jaxb-v2/doc/user-guide/ch03.html#other-miscellaneous-topics-performance-and-thread-safety ). A simple threadlocal based solution is possibly enough though; the point is avoiding creating an unmarshaller for each request, given garbage collecting it is heavy.