3.0.1 - apparmor denied mount lxc-container-default-cgns

Nope, the error you’re seeing is about a process called mount calling the mount syscall.
If it was LXC itself, you’d see comm="lxc-start" not comm="mount".