The authentication team posted a new article that might help you with diagnosing issues with authentication bottlenecks on the domain controller. Although it does not provide specific guidance, it does describe how all the elements interact (NetLogon, NTLM pass-through authentication, and the MaxConcurrentAPI setting). The article also contains links to many more additional resources which might help you with remediation.

Give it a read.

Configuring MaxConcurrentAPI for NTLM pass-through authentication