> Is this a patent violation?
This may be a patent infringement, depending on the specific patent claims and the functions actually performed by the forked software. There is no absolute answer to this question in the absence of specific patent claims. I suggest, though, that if you suspect that patents exist that Project-X infringes, this is important information for software developers to consider before contributing to or forking the code.
> Note that there is no list of patents for Project-X maintained anwhere, and Company-B is not aware of Company-A patents which it may be using in private-fork of Project-X.
This is precisely why I have repeatedly advised here at Apache that our NOTICE file retain all patent and other notices that might apply to Apache's software. In the absence of that NOTICE, Company-B is operating in the dark in a treacherous patent minefield. We owe our customers all the information we possess about potential risks.
> Does an Apache Project with Patents pose legal risk for its users?
Yes. The analysis of that risk is fact-specific, not answerable in general. Some risks can safely be ignored, others may subject you to patent litigation.
It bothers me that Apache projects don't inform our users that patents have been asserted. A recent example of this with some Adobe patents was already answered here previously, and you might want to refer to Jira LEGAL-120 for a similar issue. For the record, I disagree with current Apache legal processes concerning potential patent risks. Even IETF, which has a weak and barely-enforceable patent policy, provides more information about patent encumbrances to their specifications than we do about our software that implements those specifications. That is a disservice to our users and contributors, in my opinion.