1. All communication to the DB server are through the app server. Configured way that based on BP recommendations, security trumps performance for my company.
2. Makes sense, our DB server is a single vCPU @ 527 MHz with 4 GB of Ram and 300 GB of storage. The physical server itself is 10 year old hardware, most recent gens of intel CPUs perform better clock for clock.
Likewise our app server is just 2 vCPU @2.4 GHz on the same 10 year old hardware also running on old hard drives.
From what @amibarrett says above, my own further research and anecdotes from peers who have worked on BP developments elsewhere, the issue is most likely infrastructure.
For anyone else who comes across this thread, please comment with the approx. scale of your operations and the physical resources allocated to your BP App server and DB server.