The more we abstract things, treat servers like cattle, and lose low level knowledge, the more things like this will happen

You shouldn’t have to try to reproduce this in a test environment - your infrastructure should allow profiling in live for cases like this. And it should be solved with profiling, not guesswork and bisecting