Working with COM interfaces under ISAPI requires some consideration of the Internet Information Service thread pool architecture.
IIS maintains a pool of I/O threads that are used to call an ISAPI's callback functions. It is possible that the thread which calls your initialization code in DllMain or GetExtensionVersion will not be the same thread that calls HttpExtensionProc. It is also likely that different threads will call HttpExtensionProc from one request to another.
It is important, then, to note that COM initialization affects the thread in which it is called. For this reason, you should never initialize COM within CoInitialize or CoInitializeEx unless you will be uninitializing it before your callback function returns.
As a result of this architecture, you have three design options to use COM from ISAPI.
Because the first option forces initialization on each request (and leaves your code vulnerable to other ISAPI extensions that may have initialized COM on the IIS thread), the last option is preferred.