All you need to do is this

SELECT locationId,
    location,
FROM location_type
where city in ( ?, ? )
    and userId = ?

Now you can pass all three parameters separately.

Otherwise your , in the passed parameter to Athena is escaped; as prepared statements are supposed to.