In the mean time, as I had to give an answer for the snapshotted VM, I decided to follow one of the suggestions to run engine-setup and so also to pass my engine from 4.1.6 to 4.1.7.
And indeed the 2 stale tasks have been cleaned.
The lock symbol has gone away from the apex VM too.

Probably the steps solving the problems were these during engine-setup:

[ INFO  ] Cleaning async tasks and compensations
[ INFO  ] Unlocking existing entities

Does this mean that in general I can also run engine-setup without upgrading at all? Is the clean part run also in that case or only during effective upgrades?

I initiated a clone of the taken snapshot on apex VM and it seems to go correctly and in task pane I see only that task and no more.

In SPM now I have indeed

[root@ov300 ~]# vdsClient -s 0 getAllTasksStatuses
{'status': {'message': 'OK', 'code': 0}, 'allTasksStatus': {'20fa401f-b6f8-43f5-b0fd-6767d46e2335': {'message': 'running job 1 of 1', 'code': 0, 'taskID': '20fa401f-b6f8-43f5-b0fd-6767d46e2335', 'taskResult': '', 'taskState': 'running'}}}

[root@ov300 ~]# 

It should take about half an hour to complete and I will see.

Anyway in my opinion it would be nice to have some more in deep documentation about how to run taskcleaner.sh or simply officially say to leave it to developers if this is the intended case (or to Red Hat support in case of RHEV usage)

Cheers,
Gianluca