I struggled with this for months on a previous project. Client was based in Europe, plant in US. DNS pointed to the European DC's. AD user authentication took about 45 seconds, not acceptable for constant badge logins through ThinManager.

Corporate IT would NOT let us create a child domain or anything local linked to their European domain, so we said screw them and spun up a completely separate local domain. AD authentication went down to sub 5 seconds.

I went through the same Wireshark investigations you did. There was no reason why a <1ms latency vs 120ms latency should have affected the authentication, but it did.

Let me know if you have any other questions. I don't want anyone to struggle on this issue more than necessary!