We're measuring the response time between the timestamp of the event and when we responded to it.

So, that would be wall time. Profile with wall time then.

We do have fairly significant IO, both to disk and the network. The files are buffered writes, so we don't think that's our problem.

If you never measured it, you don't really know. I/O is nearly always the problem on modern hardware, unless you're doing 3D rendering or something similarly compute intensive.