Are you using the default `cassandra` superuser role? Because that would be expensive. Also confirm if you've set the replication for the `system_auth` keyspace to NTS because if you have multiple DCs, the request could be going to another DC.
It's interesting that you've set validity to over 3 days but you update them every 6 hours. Is that intentional? Cheers!