Firewall causing delay from web server?

Apache only does reverse dns lookups to resolve the ip addresses for access_log, if it is activated in the httpd.conf. As tiamat said, reverse dns lookups are more common in default configuration of other services like smtpd and sshd.

Regardless of what is the problem, it will show up if you follow Chris recommendation -which is the best way instead of using trial-and-error for each possibility.

Of course, if it is not a hardware-dedicated firewall and you have access on it, it would be better to run the sniffer right there. Also if the firewall can log or display it's actions on the traffic it may help.