In the constructor org.apache.pdfbox.cos.COSName.COSName(String, boolean), the field COSNam.hashCode becomes initialized after the COSName instance has been added to the cache.
Thus, concurrent threads using the cached instance may see different values in COSName.hashCode().
Just to mention, that's another problem:
The whole caching is quite dirty, because it leaks memory if the application is not aware of calling COSName.clearResources().
Ideally, the class COSName would not exist at all, since it has no benefit over using strings directly. Of course, it would be quite a hard work to get rid of it.