run wireshark to see what packets are coming in, most of line tracing I've done its usually the AD server taking the time. thing about wireshark is you can trace down the ad server name or Ip of every packet a website sent. You'd be amazed what toms site has.