Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?
Assume you have an IND-CCA secure cryptosystem $E$ that runs a password through a slow KDF and implicitly handles salts and random IVs, a human-chosen password $p$, and messages $m_1$ through $m_n$ to encrypt. Is $E_p(m_1+m_2+\cdots+m_n)$ or $E_p(m_1)+E_p(m_2)+\cdots+E_p(m_n)$ better for this? Each invocation of $E$ is slow due to it running a KDF on $p$, but an attacker only needs to guess $p$ once. This means that both techniques are equally secure against an attacker assuming $E$ takes a constant amount of time, but the former is significantly faster for honest parties, so the former is better.

The purpose of a slow KDF is to make brute force of a weak, human-generated password difficult. You need to run it each time a password is input. Assuming only one password is being input, then it only has to be run through a KDF once. The output key can be used to protect as many secrets as you wish.

The reason is simple. If an attacker manages to guess the original password, they'll be able to use it again and again to decrypt all the data, whether or not the data was encrypted all at once or encrypted piece by piece by running the password through a KDF multiple times to generate multiple keys.