I couldn't find the specifics on this but when a user converts a Lead do they need access to Standard and Custom Fields they are mapping to or do conversions run in the System context? I have some Custom Fields on Lead and Contact that I don't want users to have edit access to, but I do want to mapped from Lead to Contact. These are external fields I use with API resources.
For instance I have an external identifier named UserId that I want mapped from Lead to Contact when converted, but I don't want to give the user more than read access.