Profiling shows a visible amount of time is spent setting up and tearing down timers for the rendering timeout enforcer. Replace that with a shared ScheduledExecutorService instead, or at least try to share the Timer object used.
Unfinished work in progress here: https://github.com/aaime/geoserver/tree/timeout_scheduler
The scheduled executor service needs to be moved to a more central location and shut down when the application is released.