Using SPID in DB Tables (instead of Table Variable)
It seems to me using the @@SPID like that is asking for trouble.  

Session ID's are reused frequently; as soon as a user connection logs out, that session ID is available to be used again, and is likely to be used by the next session attempting to connect.

To make it work at least semi-reliably, you'd need a login trigger that purges prior rows from the table with the same @@SPID.  If you do that, you're likely to see a lot of locking on the table using the @@SPID column.

SQL Server does indeed use row locking, but it also uses page locking, and table locking.  Of course, you might be able to mitigate that via good indexing, but this still looks like an anti-pattern to me.  

If the stored procedure is the only method used to access the affected tables, you could investigate using an application lock, via sp_getapplock to essentially serialize access to the relevant parts.  Docs for sp_getapplock are here.  Erik Darling has an interesting post about it here.