CPU load - Not a factor, utilization is almost always less than 30% when tests are run. Nothing is running in the GUI, of the acng server, not even a browser. The out of tree module is the 'netatop' module which works inside atop and it hardly uses any cycles. The module is loaded and the netatop daemon is running all the time, and CPU utilization hasn't budged past 5% all day.
Kernel IP filters - None are running as far as I can tell, i.e. no firewall is running. Things were going well until a few weeks ago IIRC, but since it slowed to a crawl I had to revert the few clients I have to direct downloads. Using the same mirror as the acng server, the 'apt update / upgrade' cycle elapsed time immediated reverted back to the order of seconds from order of minutes. the order of seconds from the order of minutes immediately. The apt-cacher-err.log shows the debug trace of an 'apt-get update' from a client. Note the elapsed time is a tad over 3 minutes. From the same client an 'apt-get update' took about 9 seconds: time sudo apt-get update <* 27 gets *> real 0m9.601s user 0m10.649s sys 0m1.819s