Where all can I set session timeout and what is their precedence value?

Priority-1: 

Security Access Policy [NO DEFAULT TIMEOUT CONFIG] 

Priority-2: 

Custom timeouts in application itself

Priority-3: 

CGNAT-Pool [NO DEFAULT TIMEOUT CONFIG]

Priority-4 Global Setting: [DEFAULT]