I would like to highlight that we have examined the described issue with all the details provided, and still were not able to reproduce the issue within the fresh CS-Cart installation.
However, I do have one assumption: if you were upgrading your installation from a very old times, and to be more specific, some time ago you have upgraded your store to 4.9.1, then it might be that the tweak that was added in that version is missing in your installation. So the fix for the issue with orders changing their status multiple times, which is based on the tweak released back then, is not working.
Please check if these lines are present in the config.local.php file in your installation:
// Lock backend
// Available backends: database, redis, dummy
// To disable locks use dummy provider
$config['lock_backend'] = 'database';
$config['lock_redis_server'] = 'localhost';
$config['lock_redis_server_password'] = null;