The outside-vs-server replay is a clean way to narrow the fault domain, and comparing Nginx upstream time with total request time makes the mismatch concrete. One nuance: request_time minus upstream_response_time is not necessarily just response delivery; it can also include receiving the request body and proxy queueing. Logging request_length and body_bytes_sent alongside the timings could help distinguish a slow upload from a slow response path. Did response size vary across the failing runs?