How to find the reason for the periodic long opening of documents on the terminal server?

Question

RDP

We have:
Server on Windows 2016 with a deployed terminal server
RAM - 50 gig
Processor - 10 cores E5-2660 @ 2GHz
Users - 10 pieces

Problem - periodically when opening any even a small document (pdf or office) it opens in 5-10 seconds, exactly a browser can also be launched, monitoring the average read / write time counter on the disk says that everything is fine, the read or write queue to the disk is not more than 0.10, most often 0.01 (windows counters).
Moreover, at the same moment, one user has a document opened instantly, and the second has a wait of 10 seconds. The problem is observed both with files located on the network and local ones.
How to catch the problem? Everything has already been dug up.

Answer 1

Issue resolved, culprit found. An up-to-date, freshly downloaded version of VipNet CSP from the developer's site was installed and it did such dirty tricks. After installing the beta version of ViPNet_CSP_RUS_4.2.11.58000, everything returned to normal, what a harmful program....