I don't know the probe path well enough to say where the time goes, so this is mostly questions back at you.
Is it the IQN probe or the LUN probe that drags, and are we talking seconds or minutes?
Our docs describe it as two steps, xe sr-probe type=lvmoiscsi device-config:target=<ip> to list the IQNs, then the same call plus device-config:targetIQN=<iqn> for the LUNs behind one ( https://docs.xcp-ng.org/storage/manage-srs#discover-what-the-storage-offers-probe ).
Timing those by hand on the host would at least split XO's share from XAPI talking to your array.
It'd also help to know the target type, roughly how many IQNs and LUNs it exposes, and whether multipath is on, because my guess (and it's really a wild one) is that a wide target is where an enumeration gets expensive.
Might be worth a mention to @Team-Storage, who'd know what the probe does underneath.
