How to find the reason for the increase in TTFB on the route?

Question

Computer networks

Is it possible to somehow determine the culprit of the increase in TTFB on the route to the site?
I ran into an interesting problem. The user came with the problem of a long opening of the pages of our site.
The reason was an overestimated TTFB, more than 10 seconds.
At the same time, all other Internet resources opened without problems (Google, Yandex, Youtube ... TTFB < 200ms).
Connecting, determining DNS and getting content in total took no more than 100 ms, but TTFB just broke everything.
MTR in both directions showed stable ping and 0% packet loss.
The server load is below 10%, there is no connection limit exceeded, SSD disks.
The problem was reproduced only by this user, even on a test page with static content (an html page of several tens of bytes).
Moreover, the problem was intermittent, in a couple of seconds the request passed 2 times in 150 ms, and the third one could be higher than 10 seconds.
This went on for days.
When checking from different countries and regions, the problem could not be repeated, TTFB was below 100 ms everywhere.
What could be the explanation for such behavior?
P.S. Russian provider, website (dedicated server) at Hetzner.