Is there a way to remove all the ssh keys added to ssh-agent when the user locks the system?

You can watch for the events in DBUS and on lock call ssh-add -D to remove all keys from the agent:

#!/bin/bash
dbus-monitor --session "type='signal',interface='org.gnome.ScreenSaver'" |
  while read x; do
    case "$x" in 
      *"boolean true"*) echo SCREEN_LOCKED; ssh-add -D;;
      *"boolean false"*) echo SCREEN_UNLOCKED;;  
    esac
  done

But you need to export the SSH_AUTH_SOCK environment variable to this script, so it would be able to access your agent.

You can store the above into the script clean_lock.sh, set execute bits (chmod u+x clean_lock.sh) and run the script in background ./clean_lock.sh &.