Looking at CopyOnWriteArrayList.COWSubList, I see some methods that should have more synchronization:

remove(Object o)

void forEach(Consumer<? super E> action)
 array and indices must be read under lock, although elements themselves can be processed outside of lock!

Spliterator<E> spliterator()
 Similarly.

Method add(Object) is inherited from AbstractList, but that implementation has an obvious race:
    public boolean add(E e) {
        add(size(), e);