Are all UTXOs locked by an address spent in a transaction?
Transactions explicitly refer to which UTXOs they are spending.

You can construct a transaction which only spends one of the two 5-BTC UTXOs, and sends 2 BTC to the destination and 3 BTC to a (possibly new) address of yourself.

You can also construct a transaction which spends both, and sends 8 BTC back to yourself. Or it could have multiple outputs that send funds back to yourself, summing up to 8 BTC.

In short: there is nothing special about the two UTXOs that share an address, apart from the fact that the same key can sign for both - but it doesn't have to.