We have security-domain in our jboss-app.xml, I guess that counts too. I just tried to turn off RoleBasedAuthorizationInterceptorv2 in jboss-ejb3-core.jar, but it didn't help much, I think there are more places where SecurityActions.loadClass is called. Btw I realized that the the number of ejb calls is even higher, so it's like thousands of calls - that would explain why the performance is so terrible - ClassLoader.loadClass is called so many times, that even small overhead of managing lock can degrade performance significantly (especially with many threads calling that method and blocking each other).
I think we will consider change of implementation a bit and don't use EJBs so often, but anyway, I think this extreme case is showing some performance problems very well.
I can't attach the application, since it is proprietary:( I will try to append profiler snapshots tomorrow.