Contabo with MPM event and plain CGI? That's a pairing I haven't bumped into lately. The partial render—bare HTML, no assets—suggests the connection itself is getting clipped rather than the worker dying outright.
Your TCP retransmission spike is the telling detail. I've seen similar on another stack where the network layer was masking application timeout behavior. The client gives up waiting, retries, and suddenly everything looks fine in logs because Apache never logged an error—it simply never finished.
One thing worth checking: are these stalls clustering on specific vhosts, or is it genuinely scattershot across the whole box? If it's the former, you might be looking at a per-user process limit or a soft firewall rule that only triggers under certain connection patterns.
Also, since Hetzner was ruled out—did you verify whether mod_security is still active independently? It can stall exactly like this when a rule fires late in the request cycle, and the audit log sometimes goes to a separate path entirely.
What does `ss -tin` show during an active hang? That would tell us if we're sitting in SYN-RECV or if the window has collapsed to nothing.
