Actually, unless default behaviour has changed, the Tomcat connection pool does
not do a liveness check by default. Then again, Tomcat 8 switched to a different pool manager, so the documentation should be checked.
I re-read the stack trace and it's possible that a proxied
JDBC call is being done rather than a pool fetch. If that's so, my money is on someone having stored a pool Connection object in their session - which, of course, one should never do. Connection is an Interface, and thus not serializable. These days, Tomcat is supposed to reject non-serializable HttpSession objects, but I'm sure there are cases that it doesn't catch.