I'm in a similar boat, but I think we might be seeing a different problem. Our leak didn't appear until we switched to 2.6, so I'm pretty sure it's not the AccessControl problem--it was supposed to be fixed in 2.6. And we have a PostGres connection, but it's not really doing anything right now. Are you using ZEO?