@schlarbm was correct in August, the issue was with the password store in our case as well.
Once you store a password in there (even if it is never referenced), both files are opened (and passwords inside decrypted) once per every active check in your environment during change activation. With several thousand active checks in our case, this quickly added up to many seconds.
Back in August, when I stated that we didn’t use the password store, I did not fully care to verify that we did indeed not use the feature. I knew that I personally, as main Checkmk administrator, did not introduce the feature, and I knew that there was no configuration referencing the store in our environment. Unfortunately, a colleague had added a password there in the past “just for testing”, and therefore we were affected while we didn’t even benefit from the Password Store.
Issue has been raised with Checkmk devs, so I expect this is going to be resolved in a future release of 2.1.