recommendations about where to start looking?
Post the output of 'sysstat -x' . This will give a clue about the disks and what CPs the filer is doing.
The cp_ output of wafl_susp could also be interesting.
(Switch to advanced mode, run wafl_susp -z , wait about 5-10 min, run wafl_susp -w)
Regards, Adrian