Your diagnosis is right and the room-by-room approach is the cause. A pressure cascade is a network problem — the airlocks are in parallel off a shared corridor node, and when two open simultaneously the corridor has to source both make-up flows at once through supply that was sized for one. Modelling it as a network changes the corridor supply sizing significantly, typically by the flow through one additional door opening rather than by a percentage, because the binding case is the worst credible simultaneous opening rather than the sum of steady-state leakages.
The sizing input people usually miss is the door swing volume, not just the through-flow. Opening a door displaces its swept volume into or out of the airlock over roughly a second, which is a large instantaneous flow that no control loop will track. The differential recovers afterwards, but the transient is what fails an acceptance test that measures minimum differential rather than average. Whether you can fix this in control depends entirely on whether your acceptance criterion is a minimum or a recovery time — check the C&Q protocol wording before you price any ductwork.
